10

CVE-2012-6068

3S CoDeSys Improper Access Control

The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
3s-software ≫ Codesys Runtime System Version2.3.9.8
3s-software ≫ Codesys Runtime System Version2.3.9.35
3s-software ≫ Codesys Runtime System Version2.3.9.36
3s-software ≫ Codesys Runtime System Version2.3.9.37
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.27% 0.915
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
ics-cert@hq.dhs.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01
US Government Resource
http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html
Vendor Advisory
http://www.digitalbond.com/tools/basecamp/3s-codesys/
http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf
US Government Resource
https://us.codesys.com/ecosystem/security/
https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01
https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01