Lucene search

K
cve[email protected]CVE-2018-25048
HistoryMar 23, 2023 - 11:15 a.m.

CVE-2018-25048

2023-03-2311:15:12
CWE-22
web.nvd.nist.gov
15
cve-2018-25048
codesys
runtime system
vulnerability
path traversal
access
modification
system files
dos
device security

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.9%

The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

Affected configurations

NVD
Node
codesyscontrol_for_beagleboneRange3.0.0.03.5.12.30
OR
codesyscontrol_for_empc-a\/imx6Range3.0.0.03.5.12.30
OR
codesyscontrol_for_iot2000Range3.0.0.03.5.12.30
OR
codesyscontrol_for_pfc100Range3.0.0.03.5.12.30
OR
codesyscontrol_for_pfc200Range3.0.0.03.5.12.30
OR
codesyscontrol_for_raspberry_piRange3.0.0.03.5.12.30
OR
codesyscontrol_rteRange3.0.0.03.5.12.30
OR
codesyscontrol_v3_runtime_system_toolkitRange3.0.0.03.5.12.30
OR
codesyscontrol_winRange3.0.0.03.5.12.30
OR
codesysembedded_target_visu_toolkitRange3.03.5.12.30
OR
codesyshmiRange3.03.5.12.30
OR
codesysremote_target_visu_toolkitRange3.03.5.12.30
OR
codesysruntime_plcwinntRange2.0.0.02.4.7.52
OR
codesysruntime_system_toolkitRange2.0.0.02.4.7.52x86
OR
codesysruntime_system_toolkitMatch3.5.15.0
OR
codesyssimulation_runtimeRange3.0.0.03.5.12.30

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Control for BeagleBone",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": " Control for emPC-A/iMX6",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Control for IOT2000",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Control for PFC100",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Control for PFC200",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Control for Raspberry Pi",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Control RTE V3 (all variants)",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Control Win V3 (all variants)",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "V3 Simulation Runtime (part of the CODESYS Development System)",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "HMI V3 (all variants)",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "V3 Remote Target Visu (all variants)",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Control V3 Runtime System Toolkit",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "V3 Embedded Target Visu Toolkit",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "V3 Remote Target Visu Toolkit",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "3.5.12.30",
        "status": "affected",
        "version": "3.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Runtime Toolkit 32 bit embedded",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "2.3.2.10",
        "status": "affected",
        "version": "2.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Runtime Toolkit 32 bit full",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "2.4.7.52",
        "status": "affected",
        "version": "2.0.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Runtime PLCWinNT",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "2.4.7.52",
        "status": "affected",
        "version": "2.0.0.0",
        "versionType": "custom"
      }
    ]
  }
]

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.9%

Related for CVE-2018-25048