{"id":"CVE-2018-25048","state":"PUBLISHED","title":"Codesys Runtime  Improper Limitation of a Pathname","description":"The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.","publishedAt":"2023-03-23T10:45:36.900Z","updatedAt":"2025-02-19T21:00:29.711Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"CERTVDE"},"assigner":"CERTVDE","products":["CODESYS Control for BeagleBone","CODESYS  Control for emPC-A/iMX6","CODESYS Control for IOT2000","CODESYS Control for PFC100","CODESYS Control for PFC200","CODESYS Control for Raspberry Pi","CODESYS Control RTE V3 (all variants)","CODESYS Control Win V3 (all variants)","CODESYS V3 Simulation Runtime (part of the CODESYS Development System)","CODESYS HMI V3 (all variants)","CODESYS V3 Remote Target Visu (all variants)","CODESYS Control V3 Runtime System Toolkit","CODESYS V3 Embedded Target Visu Toolkit","CODESYS V3 Remote Target Visu Toolkit","CODESYS Runtime Toolkit 32 bit embedded","CODESYS Runtime Toolkit 32 bit full","CODESYS Runtime PLCWinNT"],"affected":[{"vendor":"CODESYS","product":"Control for BeagleBone","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":" Control for emPC-A/iMX6","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for IOT2000","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for PFC100","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for PFC200","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for Raspberry Pi","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control RTE V3 (all variants)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control Win V3 (all variants)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"V3 Simulation Runtime (part of the CODESYS Development System)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"HMI V3 (all variants)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"V3 Remote Target Visu (all variants)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control V3 Runtime System Toolkit","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"V3 Embedded Target Visu Toolkit","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"V3 Remote Target Visu Toolkit","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Runtime Toolkit 32 bit embedded","defaultStatus":"unaffected","versions":[{"version":"2.0.0.0","status":"affected","lessThan":"2.3.2.10","versionType":"custom"}]},{"vendor":"CODESYS","product":"Runtime Toolkit 32 bit full","defaultStatus":"unaffected","versions":[{"version":"2.0.0.0","status":"affected","lessThan":"2.4.7.52","versionType":"custom"}]},{"vendor":"CODESYS","product":"Runtime PLCWinNT","defaultStatus":"unaffected","versions":[{"version":"2.0.0.0","status":"affected","lessThan":"2.4.7.52","versionType":"custom"}]}],"references":["https://customers.codesys.com/fileadmin/data/customers/security/2018/Advisory2018-04_CDS-59017.pdf"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T19:44:44.295Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2018/25xxx/CVE-2018-25048.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2018-25048","state":"PUBLISHED","datePublished":"2023-03-23T10:45:36.900Z","dateUpdated":"2025-02-19T21:00:29.711Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2022-12-07T12:06:08.365Z"},"containers":{"cna":{"title":"Codesys Runtime  Improper Limitation of a Pathname","descriptions":[{"lang":"en","value":"The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device."}],"affected":[{"vendor":"CODESYS","product":"Control for BeagleBone","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":" Control for emPC-A/iMX6","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for IOT2000","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for PFC100","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for PFC200","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for Raspberry Pi","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control RTE V3 (all variants)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control Win V3 (all variants)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"V3 Simulation Runtime (part of the CODESYS Development System)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"HMI V3 (all variants)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"V3 Remote Target Visu (all variants)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control V3 Runtime System Toolkit","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"V3 Embedded Target Visu Toolkit","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"V3 Remote Target Visu Toolkit","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.12.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"Runtime Toolkit 32 bit embedded","defaultStatus":"unaffected","versions":[{"version":"2.0.0.0","status":"affected","lessThan":"2.3.2.10","versionType":"custom"}]},{"vendor":"CODESYS","product":"Runtime Toolkit 32 bit full","defaultStatus":"unaffected","versions":[{"version":"2.0.0.0","status":"affected","lessThan":"2.4.7.52","versionType":"custom"}]},{"vendor":"CODESYS","product":"Runtime PLCWinNT","defaultStatus":"unaffected","versions":[{"version":"2.0.0.0","status":"affected","lessThan":"2.4.7.52","versionType":"custom"}]}],"references":[{"url":"https://customers.codesys.com/fileadmin/data/customers/security/2018/Advisory2018-04_CDS-59017.pdf"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2023-03-23T10:45:36.900Z"},"credits":[{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":" Prosoft-Systems Ltd."}],"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]}],"source":{"defect":["CERT@VDE#64324"],"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://customers.codesys.com/fileadmin/data/customers/security/2018/Advisory2018-04_CDS-59017.pdf","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T12:26:39.648Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-19T21:00:23.308028Z","id":"CVE-2018-25048","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-19T21:00:29.711Z"}}]}}}