Read the docs
TI-2018-15275 Aliases CVE-2018-25048GHSA-4wf9-5wgg-q5qq

Codesys Runtime Improper Limitation of a Pathname

Priority MEDIUM 42CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01022 63rd percentileScored 2026-11-07
Fix Fixed Control for BeagleBone (CODESYS): 3.5.12.30Control for emPC-A/iMX6 (CODESYS): 3.5.12.30+15 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSControl for BeagleBone3.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYS Control for emPC-A/iMX63.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSControl for IOT20003.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSControl for PFC1003.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSControl for PFC2003.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSControl for Raspberry Pi3.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSControl RTE V3 (all variants)3.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSControl Win V3 (all variants)3.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSV3 Simulation Runtime (part of the CODESYS Development System)3.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSHMI V3 (all variants)3.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSV3 Remote Target Visu (all variants)3.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSControl V3 Runtime System Toolkit3.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSV3 Embedded Target Visu Toolkit3.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSV3 Remote Target Visu Toolkit3.0.0.0 to before 3.5.12.303.5.12.30Patch availableCNA
CODESYSRuntime Toolkit 32 bit embedded2.0.0.0 to before 2.3.2.102.3.2.10Patch availableCNA
CODESYSRuntime Toolkit 32 bit full2.0.0.0 to before 2.4.7.522.4.7.52Patch availableCNA
CODESYSRuntime PLCWinNT2.0.0.0 to before 2.4.7.522.4.7.52Patch availableCNA
  • Control for BeagleBone VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • Control for emPC-A/iMX6 VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • Control for IOT2000 VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • Control for PFC100 VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • Control for PFC200 VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • Control for Raspberry Pi VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • Control RTE V3 (all variants) VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • Control Win V3 (all variants) VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • V3 Simulation Runtime (part of the CODESYS Development System) VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • HMI V3 (all variants) VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • V3 Remote Target Visu (all variants) VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • Control V3 Runtime System Toolkit VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • V3 Embedded Target Visu Toolkit VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • V3 Remote Target Visu Toolkit VendorCODESYS Affected 3.0.0.0 to before 3.5.12.30 Fixed in 3.5.12.30 Patch available CNA
  • Runtime Toolkit 32 bit embedded VendorCODESYS Affected 2.0.0.0 to before 2.3.2.10 Fixed in 2.3.2.10 Patch available CNA
  • Runtime Toolkit 32 bit full VendorCODESYS Affected 2.0.0.0 to before 2.4.7.52 Fixed in 2.4.7.52 Patch available CNA
  • Runtime PLCWinNT VendorCODESYS Affected 2.0.0.0 to before 2.4.7.52 Fixed in 2.4.7.52 Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_for_beaglebone:*:*:*:*:*:*:*:*3.0.0.0 to before 3.5.12.30VulnerableCODESYS
cpe:2.3:a:codesys:control_for_empc-a\/imx6:*:*:*:*:*:*:*:*3.0.0.0 to before 3.5.12.30VulnerableCODESYS
cpe:2.3:a:codesys:control_for_iot2000:*:*:*:*:*:*:*:*3.0.0.0 to before 3.5.12.30VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc100:*:*:*:*:*:*:*:*3.0.0.0 to before 3.5.12.30VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc200:*:*:*:*:*:*:*:*3.0.0.0 to before 3.5.12.30VulnerableCODESYS
cpe:2.3:a:codesys:control_for_raspberry_pi:*:*:*:*:*:*:*:*3.0.0.0 to before 3.5.12.30VulnerableCODESYS
cpe:2.3:a:codesys:control_rte:*:*:*:*:*:*:*:*3.0.0.0 to before 3.5.12.30VulnerableCODESYS
cpe:2.3:a:codesys:control_v3_runtime_system_toolkit:*:*:*:*:*:*:*:*3.0.0.0 to before 3.5.12.30VulnerableCODESYS
cpe:2.3:a:codesys:control_win:*:*:*:*:*:*:*:*3.0.0.0 to before 3.5.12.30VulnerableCODESYS
cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:*3.0 to before 3.5.12.30VulnerableCODESYS
  • cpe:2.3:a:codesys:control_for_beaglebone:*:*:*:*:*:*:*:* Versions 3.0.0.0 to before 3.5.12.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_empc-a\/imx6:*:*:*:*:*:*:*:* Versions 3.0.0.0 to before 3.5.12.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_iot2000:*:*:*:*:*:*:*:* Versions 3.0.0.0 to before 3.5.12.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc100:*:*:*:*:*:*:*:* Versions 3.0.0.0 to before 3.5.12.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc200:*:*:*:*:*:*:*:* Versions 3.0.0.0 to before 3.5.12.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_raspberry_pi:*:*:*:*:*:*:*:* Versions 3.0.0.0 to before 3.5.12.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_rte:*:*:*:*:*:*:*:* Versions 3.0.0.0 to before 3.5.12.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_v3_runtime_system_toolkit:*:*:*:*:*:*:*:* Versions 3.0.0.0 to before 3.5.12.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_win:*:*:*:*:*:*:*:* Versions 3.0.0.0 to before 3.5.12.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:* Versions 3.0 to before 3.5.12.30 Vulnerable ·CODESYS
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:*3.0 to before 3.5.12.30VulnerableCODESYS
cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:*3.0 to before 3.5.12.30VulnerableCODESYS
cpe:2.3:a:codesys:runtime_plcwinnt:*:*:*:*:*:*:*:*2.0.0.0 to before 2.4.7.52VulnerableCODESYS
cpe:2.3:a:codesys:runtime_system_toolkit:*:*:*:*:*:*:x86:*2.0.0.0 to before 2.4.7.52VulnerableCODESYS
cpe:2.3:a:codesys:runtime_system_toolkit:3.5.15.0:*:*:*:*:*:*:*3.5.15.0VulnerableCODESYS
cpe:2.3:a:codesys:simulation_runtime:*:*:*:*:*:*:*:*3.0.0.0 to before 3.5.12.30VulnerableCODESYS
  • cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:* Versions 3.0 to before 3.5.12.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:* Versions 3.0 to before 3.5.12.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:runtime_plcwinnt:*:*:*:*:*:*:*:* Versions 2.0.0.0 to before 2.4.7.52 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:runtime_system_toolkit:*:*:*:*:*:*:x86:* Versions 2.0.0.0 to before 2.4.7.52 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:runtime_system_toolkit:3.5.15.0:*:*:*:*:*:*:* Versions 3.5.15.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:simulation_runtime:*:*:*:*:*:*:*:* Versions 3.0.0.0 to before 3.5.12.30 Vulnerable ·CODESYS

Remediation

  • Fix · CNA Control for BeagleBone (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA Control for emPC-A/iMX6 (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA Control for IOT2000 (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA Control for PFC100 (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA Control for PFC200 (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA Control for Raspberry Pi (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA Control RTE V3 (all variants) (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA Control Win V3 (all variants) (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA V3 Simulation Runtime (part of the CODESYS Development System) (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA HMI V3 (all variants) (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA V3 Remote Target Visu (all variants) (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA Control V3 Runtime System Toolkit (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA V3 Embedded Target Visu Toolkit (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA V3 Remote Target Visu Toolkit (CODESYS) Fixed in 3.5.12.30
  • Fix · CNA Runtime Toolkit 32 bit embedded (CODESYS) Fixed in 2.3.2.10
  • Fix · CNA Runtime Toolkit 32 bit full (CODESYS) Fixed in 2.4.7.52
  • Fix · CNA Runtime PLCWinNT (CODESYS) Fixed in 2.4.7.52

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-25048
  2. 2026-10-03 Alias added: GHSA-4wf9-5wgg-q5qq

References

Other 1

  • TI-2019-10180 Stack-based buffer overflow in CODESYS V3 web server CVSS 3.1CRITICAL 9.8
  • TI-2020-08257 CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. CVSS 3.1CRITICAL 9.8
  • TI-2019-13592 CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2019-06495 An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. CVSS 3.1HIGH 8.8
  • TI-2019-10164 Path traversal in CODESYS V3 web server CVSS 3.1HIGH 7.5
  • TI-2020-12439 CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation. CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences