Vulnerabilities

TI-2018-03954 CVE-2018-5440 · GHSA-8jg4-q5rf-9hjg

Stack-based buffer overflow in 3S-Smart Software Solutions GmbH CODESYS Web Server

MEDIUM 48

A Stack-based Buffer Overflow issue was discovered in 3S-Smart CODESYS Web Server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03096 Published 2018-02-15 No fix listed CWE-121

TI-2015-05445 CVE-2015-6482 · GHSA-qcv4-42jw-9gpj

Runtime Toolkit before 2.4.7.48 in 3S-Smart CODESYS before 2.3.9.48 allows remote…

LOW 27

Runtime Toolkit before 2.4.7.48 in 3S-Smart CODESYS before 2.3.9.48 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted request.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02066 Published 2015-10-18 No fix listed

TI-2014-00717 CVE-2014-0769 · GHSA-q52x-cg29-xrxr

Festo CECX-X-(C1/M1) Controller Improper Authentication

MEDIUM 45

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to…

CVSS 2.0CRITICAL 9.3 Network No auth Interaction — EPSS 0.02316 Published 2014-04-25 No fix listed CWE-287

TI-2014-00708 CVE-2014-0760 · GHSA-m299-9mh6-7cv5

Festo CECX-X-(C1/M1) Controller Improper Authentication

MEDIUM 46

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which could allow a remote attacke…

CVSS 2.0CRITICAL 9.3 Network No auth Interaction — EPSS 0.03345 Published 2014-04-25 No fix listed CWE-287

TI-2014-00705 CVE-2014-0757 · GHSA-jh4r-j37p-c5mv

Smart Software Solutions (3S) CoDeSys Runtime Toolkit NULL Pointer Dereference

LOW 38

Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.

CVSS 2.0HIGH 7.1 Network No auth Interaction — EPSS 0.0365 Published 2014-01-31 Fixed in V2.4.7.44 CWE-476

TI-2013-02429 CVE-2013-2781 · GHSA-g4gg-mp54-wh67

Use-after-free vulnerability in the server application in 3S CODESYS Gateway 2.3.9.27…

MEDIUM 49

Use-after-free vulnerability in the server application in 3S CODESYS Gateway 2.3.9.27 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via unspecified vectors.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03799 Published 2013-05-23 No fix listed CWE-399

TI-2012-04014 CVE-2012-4708 · GHSA-7xf5-mxr3-wr6m

Stack-based buffer overflow in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote…

MEDIUM 53

Stack-based buffer overflow in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted packet.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07427 Published 2013-02-24 No fix listed CWE-119

TI-2012-04013 CVE-2012-4707 · GHSA-939j-jgg3-c2p9

3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary…

MEDIUM 49

3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors that trigger an out-of-bounds memory access.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03562 Published 2013-02-24 No fix listed CWE-94

TI-2012-04012 CVE-2012-4706 · GHSA-xj89-wxvh-5m7p

Integer signedness error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote…

LOW 37

Integer signedness error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to cause a denial of service via a crafted packet that triggers a heap-based buffer overflow.

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.01606 Published 2013-02-24 No fix listed CWE-189

TI-2012-04011 CVE-2012-4705 · GHSA-2gp3-6mvr-759r

Directory traversal vulnerability in 3S CODESYS Gateway-Server before 2.3.9.27 allows…

HIGH 79

Directory traversal vulnerability in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors involving a crafted pathname.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.6487 Published 2013-02-24 No fix listed CWE-22

TI-2012-04010 CVE-2012-4704 · GHSA-chg6-w8w8-cphc

Array index error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to…

MEDIUM 50

Array index error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted packet.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04151 Published 2013-02-24 No fix listed CWE-20

TI-2012-05033 CVE-2012-6069 · GHSA-6q9j-3828-rfxj

3S CoDeSys Relative Path Traversal

MEDIUM 48

The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02637 Published 2013-01-21 Fixed in 2.3.2.8, 2.4.7.40 +2 CWE-23

TI-2012-05032 CVE-2012-6068 · GHSA-hh9j-6v4h-23q7

3S CoDeSys Improper Access Control

MEDIUM 50

The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer file…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05266 Published 2013-01-21 Fixed in 2.3.2.8, 2.4.7.40 +2 CWE-284

Vulnerabilities

Filters