Authentication flaw

2013-01-2121:55:00

PRIOn knowledge base

www.prio-n.com

7.7 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

75.7%

JSON

The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to (1) execute commands via the command-line interface in the TCP listener service or (2) transfer files via requests to the TCP listener service.

CPENameOperatorVersion
codesys_runtime_systemeq2.3.9.35
codesys_runtime_systemeq2.3.9.8
codesys_runtime_systemeq2.3.9.36
codesys_runtime_systemeq2.3.9.37
codesys_runtime_systemeq2.4.0

Name	Operator	Version
codesys_runtime_system	eq	2.3.9.35
codesys_runtime_system	eq	2.3.9.8
codesys_runtime_system	eq	2.3.9.36
codesys_runtime_system	eq	2.3.9.37
codesys_runtime_system	eq	2.4.0