CVE-2012-6068 3S CoDeSys Improper Access Control
CriticalCVSS 9.8
EPSS 5.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 3s-software codesys runtime system | = 2.3.9.8 | No fix listed |
| 3s-software codesys runtime system | = 2.3.9.35 | No fix listed |
| 3s-software codesys runtime system | = 2.3.9.36 | No fix listed |
| 3s-software codesys runtime system | = 2.3.9.37 | No fix listed |
| 3s-software codesys runtime system | = 2.4.0 | No fix listed |
| 3s-smart software solutions CODESYS Control Runtime embedded | < 2.3.2.8 | 2.3.2.8 |
| 3s-smart software solutions CODESYS Control Runtime full | < 2.4.7.40 | 2.4.7.40 |
| 3s-smart software solutions CODESYS Control RTE | < 2.3.7.17 | 2.3.7.17 |
| festo CECX-X-C1 Modular Master Controller with CoDeSys | All versions | No fix listed |
| festo CECX-X-M1 Modular Controller with CoDeSys and SoftMotion | All versions | No fix listed |
References
- www.codesys.com vendor-advisory
- www.digitalbond.com
- us.codesys.com
- www.cisa.gov
- www.cisa.gov
- ics-cert.us-cert.gov us-government-resource
- www.us-cert.gov us-government-resource