8.8

CVE-2018-25048

The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

Data is provided by the National Vulnerability Database (NVD)
Codesys ≫ Control For Beaglebone Version >= 3.0.0.0 < 3.5.12.30
Codesys ≫ Control For Empc-a/imx6 Version >= 3.0.0.0 < 3.5.12.30
Codesys ≫ Control For Iot2000 Version >= 3.0.0.0 < 3.5.12.30
Codesys ≫ Control For Pfc100 Version >= 3.0.0.0 < 3.5.12.30
Codesys ≫ Control For Pfc200 Version >= 3.0.0.0 < 3.5.12.30
Codesys ≫ Control For Raspberry Pi Version >= 3.0.0.0 < 3.5.12.30
Codesys ≫ Control Rte Version >= 3.0.0.0 < 3.5.12.30
Codesys ≫ Control V3 Runtime System Toolkit Version >= 3.0.0.0 < 3.5.12.30
Codesys ≫ Control Win Version >= 3.0.0.0 < 3.5.12.30
Codesys ≫ Embedded Target Visu Toolkit Version >= 3.0 < 3.5.12.30
Codesys ≫ Hmi Version >= 3.0 < 3.5.12.30
Codesys ≫ Remote Target Visu Toolkit Version >= 3.0 < 3.5.12.30
Codesys ≫ Runtime Plcwinnt Version >= 2.0.0.0 < 2.4.7.52
Codesys ≫ Runtime System Toolkit HwPlatformx86 Version >= 2.0.0.0 < 2.4.7.52
Codesys ≫ Runtime System Toolkit Version3.5.15.0
Codesys ≫ Simulation Runtime Version >= 3.0.0.0 < 3.5.12.30
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.46% 0.61
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
info@cert.vde.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.