← Retour aux CVEs

CVE-2012-6069

CRITICAL

10.0

Description

The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This could allow the attacker to affect the availability, integrity, and confidentiality of the device.

Details CVE

Score CVSS v3.110.0

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie1/21/2013

Derniere modification7/2/2025

Sourcenvd

Observations honeypot0

Produits affectes

3s-software:codesys_runtime_system

Faiblesses (CWE)

CWE-23CWE-22

References

http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html(ics-cert@hq.dhs.gov)

http://www.digitalbond.com/tools/basecamp/3s-codesys/(ics-cert@hq.dhs.gov)

https://us.codesys.com/ecosystem/security/(ics-cert@hq.dhs.gov)

https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01(ics-cert@hq.dhs.gov)

https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01(ics-cert@hq.dhs.gov)

http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01(af854a3a-2127-422b-91ae-364da2661108)

http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.digitalbond.com/tools/basecamp/3s-codesys/(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/56300(af854a3a-2127-422b-91ae-364da2661108)

http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.