Path Traversal in 3s-Smart Software Solutions Codesys
CVE-2012-6069
The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This could allow the attacker to affect the availability, integrity, and confidentiality of the device.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.026 (85.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 85.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.026 · newest: 0.026 · change: 0.000
Affected products
- 3s-Smart Software Solutions Codesys — versions 3.X
- 3s-Smart Software Solutions Codesys Control Rte — versions 0
- 3s-Smart Software Solutions Codesys Control Runtime Embedded — versions 0
- 3s-Smart Software Solutions Codesys Control Runtime Full — versions 0
- 3s-Software Codesys Runtime System — versions 2.4.0, 2.3.9.8, 2.3.9.35
- Festo Cecx-X-C1 Modular Master Controller With Codesys — versions All
- Festo Cecx-X-M1 Modular Controller With Codesys And Softmotion — versions All
Weakness classification (CWE)
References
- www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-… (Vendor Advisory)
- www.cisa.gov/news-events/ics-advisories/icsa-13-011-01
- www.digitalbond.com/tools/basecamp/3s-codesys/
- www.cisa.gov/news-events/ics-advisories/icsa-14-084-01
- us.codesys.com/ecosystem/security/
- af854a3a-2127-422b-91ae-364da2661108 (US Government Resource)
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 (US Government Resource)
Frequently asked questions
- What is CVE-2012-6069?
- CVE-2012-6069 is a critical-severity vulnerability in 3s-Smart Software Solutions Codesys, classified under Relative Path Traversal. CVSS score: 10.0/10. Published 2013-01-21.
- How severe is CVE-2012-6069?
- Critical severity. CVSS v3 base score is 10.0 out of 10.