CVE-2018-25048

The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

• codesys control for beaglebone (>= 3.0.0.0 < 3.5.12.30) • codesys control for empc-a\/imx6 (>= 3.0.0.0 < 3.5.12.30) • codesys control for iot2000 (>= 3.0.0.0 < 3.5.12.30) • codesys control for pfc100 (>= 3.0.0.0 < 3.5.12.30) • codesys control for pfc200 (>= 3.0.0.0 < 3.5.12.30) • codesys control for raspberry pi (>= 3.0.0.0 < 3.5.12.30) • codesys control rte (>= 3.0.0.0 < 3.5.12.30) • codesys control v3 runtime system toolkit (>= 3.0.0.0 < 3.5.12.30) • codesys control win (>= 3.0.0.0 < 3.5.12.30) • codesys embedded target visu toolkit (>= 3.0 < 3.5.12.30) • codesys hmi (>= 3.0 < 3.5.12.30) • codesys remote target visu toolkit (>= 3.0 < 3.5.12.30) • codesys runtime plcwinnt (>= 2.0.0.0 < 2.4.7.52) • codesys runtime system toolkit (>= 2.0.0.0 < 2.4.7.52) • codesys runtime system toolkit 3.5.15.0 • codesys simulation runtime (>= 3.0.0.0 < 3.5.12.30)