CVE-2012-6069
critical
CVSS v3
10.0
CVSS v2
10.0
VIR risk
10.0
Description
The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This could allow the attacker to affect the availability, integrity, and confidentiality of the device.
Predictions
Exploit likelihood
98%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: ics-cert@hq.dhs.gov — http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| 3s-software | codesys_runtime_system | 2.4.0 | |
| 3s-software | codesys_runtime_system | 2.3.9.8 | |
| 3s-software | codesys_runtime_system | 2.3.9.35 | |
| 3s-software | codesys_runtime_system | 2.3.9.36 | |
| 3s-software | codesys_runtime_system | 2.3.9.37 | |
References
- http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html
- http://www.digitalbond.com/tools/basecamp/3s-codesys/
- https://us.codesys.com/ecosystem/security/
- https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01
- http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01
- http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html
- http://www.digitalbond.com/tools/basecamp/3s-codesys/
- http://www.securityfocus.com/bid/56300
- http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf
CWEs
CWE-23 CWE-22
Verify integrity in audit chain (admin only). AS-IS.