The CoDeSys Runtime Toolkit’s file transfer functionality does not
perform input validation, which allows an attacker to access files and
directories outside the intended scope. This may allow an attacker to
upload and download any file on the device. This could allow the
attacker to affect the availability, integrity, and confidentiality of
the device.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
CODESYS Control Runtime embedded
Vendor
3S-Smart Software Solutions
Product
CODESYS Control Runtime embedded
Platforms
Unknown
Default status
unaffected
CODESYS Control Runtime embedded · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
2.3.2.8
Unavailable
None listed
CODESYS Control Runtime full
Vendor
3S-Smart Software Solutions
Product
CODESYS Control Runtime full
Platforms
Unknown
Default status
unaffected
CODESYS Control Runtime full · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
2.4.7.40
Unavailable
None listed
CODESYS Control RTE
Vendor
3S-Smart Software Solutions
Product
CODESYS Control RTE
Platforms
Unknown
Default status
unaffected
CODESYS Control RTE · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
2.3.7.17
Unavailable
None listed
CECX-X-C1 Modular Master Controller with CoDeSys
Vendor
Festo
Product
CECX-X-C1 Modular Master Controller with CoDeSys
Platforms
Unknown
Default status
unaffected
CECX-X-C1 Modular Master Controller with CoDeSys · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All
affected
Unavailable
Unavailable
Unavailable
None listed
CECX-X-M1 Modular Controller with CoDeSys and SoftMotion
Vendor
Festo
Product
CECX-X-M1 Modular Controller with CoDeSys and SoftMotion
Platforms
Unknown
Default status
unaffected
CECX-X-M1 Modular Controller with CoDeSys and SoftMotion · Scoped product and version facts