CVEvulnerability

CVE-2018-10612

9.8 CRITICAL Published 2019-01-29 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-01-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-284, CWE-311, CWE-732

Description

In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.

Affected configurations

• codesys control for beaglebone sl (>= 3.0 < 3.5.14.0) • codesys control for empc-a\/imx6 sl (>= 3.0 < 3.5.14.0) • codesys control for iot2000 sl (>= 3.0 < 3.5.14.0) • codesys control for linux sl (>= 3.0 < 3.5.14.0) • codesys control for pfc100 sl (>= 3.0 < 3.5.14.0) • codesys control for pfc200 sl (>= 3.0 < 3.5.14.0) • codesys control for raspberry pi sl (>= 3.0 < 3.5.14.0) • codesys control rte sl (>= 3.0 < 3.5.14.0) • codesys control runtime toolkit (>= 3.0 < 3.5.14.0) • codesys control win sl (>= 3.0 < 3.5.14.0) • codesys development system v3 (>= 3.0 < 3.5.14.0) • codesys hmi sl (>= 3.0 < 3.5.14.0)

Related

Weakness · CWE (3)

  • CWE-284 Improper Access Control weakness
  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References