Vulnerability Details : CVE-2018-25048
The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.
Vulnerability category: Directory traversalDenial of service
Products affected by CVE-2018-25048
- cpe:2.3:a:codesys:control_for_beaglebone:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_empc-a\/imx6:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_iot2000:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_pfc100:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_pfc200:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_raspberry_pi:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_rte:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_win:*:*:*:*:*:*:*:*
- Codesys » Runtime System Toolkit » For X86Versions from including (>=) 2.0.0.0 and before (<) 2.4.7.52cpe:2.3:a:codesys:runtime_system_toolkit:*:*:*:*:*:*:x86:*
- cpe:2.3:a:codesys:runtime_system_toolkit:3.5.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:simulation_runtime:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:runtime_plcwinnt:*:*:*:*:*:*:*:*
- Codesys » Control V3 Runtime System ToolkitVersions from including (>=) 3.0.0.0 and before (<) 3.5.12.30cpe:2.3:a:codesys:control_v3_runtime_system_toolkit:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-25048
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 22 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-25048
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
CERT VDE |
CWE ids for CVE-2018-25048
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: info@cert.vde.com (Primary)
References for CVE-2018-25048
-
https://customers.codesys.com/fileadmin/data/customers/security/2018/Advisory2018-04_CDS-59017.pdf
Customer Portal - Customer PortalNot Applicable
Jump to