1. Home
  2. CVE Database
  3. CVE-2018-25048
HIGH · 8.8

CVE-2018-25048

The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

Vulnerability Description

The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
CodesysControl For Beaglebone>= 3.0.0.0, < 3.5.12.30
CodesysControl For Empc-A\/Imx6>= 3.0.0.0, < 3.5.12.30
CodesysControl For Iot2000>= 3.0.0.0, < 3.5.12.30
CodesysControl For Pfc100>= 3.0.0.0, < 3.5.12.30
CodesysControl For Pfc200>= 3.0.0.0, < 3.5.12.30
CodesysControl For Raspberry Pi>= 3.0.0.0, < 3.5.12.30
CodesysControl Rte>= 3.0.0.0, < 3.5.12.30
CodesysControl V3 Runtime System Toolkit>= 3.0.0.0, < 3.5.12.30
CodesysControl Win>= 3.0.0.0, < 3.5.12.30
CodesysEmbedded Target Visu Toolkit>= 3.0, < 3.5.12.30
CodesysHmi>= 3.0, < 3.5.12.30
CodesysRemote Target Visu Toolkit>= 3.0, < 3.5.12.30
CodesysRuntime Plcwinnt>= 2.0.0.0, < 2.4.7.52
CodesysRuntime System Toolkit>= 2.0.0.0, < 2.4.7.52
CodesysSimulation Runtime>= 3.0.0.0, < 3.5.12.30

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2018-25048?

CVE-2018-25048 is a vulnerability with a CVSS score of 8.8 (HIGH). The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

How severe is CVE-2018-25048?

CVE-2018-25048 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-25048?

Check the references section above for vendor advisories and patch information. Affected products include: Codesys Control For Beaglebone, Codesys Control For Empc-A\/Imx6, Codesys Control For Iot2000, Codesys Control For Pfc100, Codesys Control For Pfc200.