Description (CNA)
The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CODESYS / Control for BeagleBone | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / Control for emPC-A/iMX6 | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / Control for IOT2000 | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / Control for PFC100 | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / Control for PFC200 | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / Control for Raspberry Pi | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / Control RTE V3 (all variants) | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / Control Win V3 (all variants) | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / V3 Simulation Runtime (part of the CODESYS Development System) | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / HMI V3 (all variants) | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / V3 Remote Target Visu (all variants) | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / Control V3 Runtime System Toolkit | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / V3 Embedded Target Visu Toolkit | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / V3 Remote Target Visu Toolkit | affected 3.0.0.0 before 3.5.12.30 |
| CODESYS / Runtime Toolkit 32 bit embedded | affected 2.0.0.0 before 2.3.2.10 |
| CODESYS / Runtime Toolkit 32 bit full | affected 2.0.0.0 before 2.4.7.52 |
| CODESYS / Runtime PLCWinNT | affected 2.0.0.0 before 2.4.7.52 |
CWE
CWE-22
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.