CVE-2012-6069 (GCVE-0-2012-6069)
Vulnerability from cvelistv5
Published
2013-01-21 21:00
Modified
2025-07-02 20:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
The CoDeSys Runtime Toolkit’s file transfer functionality does not
perform input validation, which allows an attacker to access files and
directories outside the intended scope. This may allow an attacker to
upload and download any file on the device. This could allow the
attacker to affect the availability, integrity, and confidentiality of
the device.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | 3S-Smart Software Solutions | CODESYS Control Runtime embedded |
Version: 0 < 2.3.2.8 |
||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:21:28.402Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "56300",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/56300"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitalbond.com/tools/basecamp/3s-codesys/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CODESYS Control Runtime embedded",
"vendor": "3S-Smart Software Solutions",
"versions": [
{
"lessThan": "2.3.2.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control Runtime full",
"vendor": "3S-Smart Software Solutions",
"versions": [
{
"lessThan": "2.4.7.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control RTE",
"vendor": "3S-Smart Software Solutions",
"versions": [
{
"lessThan": "2.3.7.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CECX-X-C1 Modular Master Controller with CoDeSys",
"vendor": "Festo",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CECX-X-M1 Modular Controller with CoDeSys and SoftMotion",
"vendor": "Festo",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CoDeSys",
"vendor": "3S-Smart Software Solutions",
"versions": [
{
"status": "unaffected",
"version": "3.X"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Independent researcher Reid Wightman of IOActive, formerly of Digital Bond has validated that the patch, issued by 3S, mitigates theses vulnerabilities."
}
],
"datePublic": "2012-10-31T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\nThe CoDeSys Runtime Toolkit\u2019s file transfer functionality does not \nperform input validation, which allows an attacker to access files and \ndirectories outside the intended scope. This may allow an attacker to \nupload and download any file on the device. This could allow the \nattacker to affect the availability, integrity, and confidentiality of \nthe device.\n\n\u003c/p\u003e"
}
],
"value": "The CoDeSys Runtime Toolkit\u2019s file transfer functionality does not \nperform input validation, which allows an attacker to access files and \ndirectories outside the intended scope. This may allow an attacker to \nupload and download any file on the device. This could allow the \nattacker to affect the availability, integrity, and confidentiality of \nthe device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-02T20:15:19.655Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitalbond.com/tools/basecamp/3s-codesys/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01"
},
{
"url": "https://us.codesys.com/ecosystem/security/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CoDeSys recommends upgrading to the latest version, which is Version 3. It can be downloaded \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://store.codesys.com/engineering/codesys.html?___store=en#All%20versions\"\u003ehere\u003c/a\u003e.\u003cp\u003e3S released a patch which implements a password for authentication to the device.\u003c/p\u003e\u003cp\u003eThe patch can be downloaded from the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.codesys.com/download.html\"\u003eCoDeSys Download Center\u003c/a\u003e.\u003c/p\u003eCoDeSys Version 3.X is not affected by these vulnerabilities.\n\n\u003cbr\u003e"
}
],
"value": "CoDeSys recommends upgrading to the latest version, which is Version 3. It can be downloaded here https://store.codesys.com/engineering/codesys.html .3S released a patch which implements a password for authentication to the device.\n\nThe patch can be downloaded from the CoDeSys Download Center http://www.codesys.com/download.html .\n\nCoDeSys Version 3.X is not affected by these vulnerabilities."
}
],
"source": {
"advisory": "ICSA-13-011-01",
"discovery": "EXTERNAL"
},
"title": "3S CoDeSys Relative Path Traversal",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "3S also recommends the usage of standard security methods like firewalls\n or virtual private network (VPN) access to prevent unauthorized access \nto the controller.\n\n\u003cbr\u003e"
}
],
"value": "3S also recommends the usage of standard security methods like firewalls\n or virtual private network (VPN) access to prevent unauthorized access \nto the controller."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2012-6068",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to (1) execute commands via the command-line interface in the TCP listener service or (2) transfer files via requests to the TCP listener service."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html",
"refsource": "CONFIRM",
"url": "http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html"
},
{
"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01",
"refsource": "MISC",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01"
},
{
"name": "http://www.digitalbond.com/tools/basecamp/3s-codesys/",
"refsource": "MISC",
"url": "http://www.digitalbond.com/tools/basecamp/3s-codesys/"
},
{
"name": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf",
"refsource": "MISC",
"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2012-6069",
"datePublished": "2013-01-21T21:00:00",
"dateReserved": "2012-12-05T00:00:00",
"dateUpdated": "2025-07-02T20:15:19.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2012-6069\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2013-01-21T21:55:01.150\",\"lastModified\":\"2025-07-02T21:15:39.193\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The CoDeSys Runtime Toolkit\u2019s file transfer functionality does not \\nperform input validation, which allows an attacker to access files and \\ndirectories outside the intended scope. This may allow an attacker to \\nupload and download any file on the device. This could allow the \\nattacker to affect the availability, integrity, and confidentiality of \\nthe device.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de salto de directorio en el Runtime Toolkit de CODESYS Runtime System v2.3.x y v2.4.x que permite a atacantes remotos leer, sobreescribir, o crear ficheros a trav\u00e9s de .. (punto punto) en una solicitud al servicio de escucha TCP.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-23\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3s-software:codesys_runtime_system:2.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"89253C44-34F0-457C-9EEE-E7028F737E02\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3s-software:codesys_runtime_system:2.3.9.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CFAB8128-4A70-44CA-A4D3-C859010C8BFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3s-software:codesys_runtime_system:2.3.9.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B99BA40-647D-4203-A003-CAEEF776EF77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3s-software:codesys_runtime_system:2.3.9.36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50443443-14B4-4245-BBE3-C5E451739EF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3s-software:codesys_runtime_system:2.3.9.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"44C690B5-EE5B-4504-B40D-879F757C8029\"}]}]}],\"references\":[{\"url\":\"http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.digitalbond.com/tools/basecamp/3s-codesys/\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://us.codesys.com/ecosystem/security/\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.digitalbond.com/tools/basecamp/3s-codesys/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/56300\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"US Government Resource\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…