8.8
High
CVE-2018-25048 The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal…
Description
The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Control for BeagleBone 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| Control for emPC-A/iMX6 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| Control for IOT2000 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| Control for PFC100 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| Control for PFC200 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| Control for Raspberry Pi 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| Control RTE V3 (all variants) 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| Control Win V3 (all variants) 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| V3 Simulation Runtime (part of the CODESYS Development System) 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
Show the 8 other branches Hide the 8 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| HMI V3 (all variants) 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| V3 Remote Target Visu (all variants) 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| Control V3 Runtime System Toolkit 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| V3 Embedded Target Visu Toolkit 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| V3 Remote Target Visu Toolkit 3.0 | 3.0.0.0 → < 3.5.12.30 | 3.5.12.30 |
| Runtime Toolkit 32 bit embedded 2.0 | 2.0.0.0 → < 2.3.2.10 | 2.3.2.10 |
| Runtime Toolkit 32 bit full 2.0 | 2.0.0.0 → < 2.4.7.52 | 2.4.7.52 |
| Runtime PLCWinNT 2.0 | 2.0.0.0 → < 2.4.7.52 | 2.4.7.52 |