CVE-2012-6068
CRITICALCODESYS Runtime System 2.3.x-2.4.x - Unauthenticated Remote Code Execution via TCP Listener Service
Title source: llmDescription
The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service.
References (7)
Core 7
Core References
US Government Resource
http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01
US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf
Various Sources
https://us.codesys.com/ecosystem/security/
Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01
Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01
Vendor Advisory x_refsource_confirm
http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html
Various Sources x_refsource_misc
http://www.digitalbond.com/tools/basecamp/3s-codesys/
Scores
CVSS v3
9.8
EPSS
0.0527
EPSS Percentile
91.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-264
CWE-284
Status
published
Products (11)
3S-Smart Software Solutions/CoDeSys
3.X
3S-Smart Software Solutions/CODESYS Control RTE
< 2.3.7.17
3S-Smart Software Solutions/CODESYS Control Runtime embedded
< 2.3.2.8
3S-Smart Software Solutions/CODESYS Control Runtime full
< 2.4.7.40
3s-software/codesys_runtime_system
2.3.9.8
3s-software/codesys_runtime_system
2.3.9.35
3s-software/codesys_runtime_system
2.3.9.36
3s-software/codesys_runtime_system
2.3.9.37
3s-software/codesys_runtime_system
2.4.0
Festo/CECX-X-C1 Modular Master Controller with CoDeSys
All
... and 1 more
Published
Jan 21, 2013
Tracked Since
Feb 18, 2026