Vulnerability in 3s-Smart Software Solutions Gmbh Codesys Control V3 Products Prior To Version 3.5.14.0
CVE-2018-10612
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.013 (68.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 68.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- 3s-Smart Software Solutions Gmbh Codesys Control V3 Products Prior To Version 3.5.14.0 — versions 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0
- Codesys Control For Beaglebone Sl
- Codesys Control For Empc-A\/imx6 Sl
- Codesys Control For Iot2000 Sl
- Codesys Control For Linux Sl
- Codesys Control For Pfc100 Sl
- Codesys Control For Pfc200 Sl
- Codesys Control For Raspberry Pi Sl
- Codesys Control Rte Sl
- Codesys Control Runtime Toolkit
Weakness classification (CWE)
References
- www.securityfocus.com/bid/106248 (VDB Entry, Third Party Advisory, vdb-entry)
- ics-cert.us-cert.gov/advisories/ICSA-18-352-03 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-10612?
- CVE-2018-10612 is a critical-severity vulnerability in 3s-Smart Software Solutions Gmbh Codesys Control V3 Products Prior To Version 3.5.14.0, classified under Improper Access Control. CVSS score: 9.8/10. Published 2019-01-29.
- How severe is CVE-2018-10612?
- Critical severity. CVSS v3 base score is 9.8 out of 10.