CVE-2012-6069 | BDVDB-2026-54238 Detail
3S-Smart Software SolutionsCODESYS Control Runtime embedded
Description#
The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This could allow the attacker to affect the availability, integrity, and confidentiality of the device.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
References#
- http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html
- https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01
- http://www.digitalbond.com/tools/basecamp/3s-codesys/
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01
- https://us.codesys.com/ecosystem/security/
- http://www.securityfocus.com/bid/56300
- http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01
- http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.