CVE-2018-25048

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2018
Source publication: Mar 23, 2023
Source updated: Feb 19, 2025
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Codesys Runtime Improper Limitation of a Pathname

The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Control for BeagleBone

Vendor: CODESYS
Product: Control for BeagleBone
Platforms: Unknown
Default status: unaffected

Control for BeagleBone · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

Control for emPC-A/iMX6

Vendor: CODESYS
Product: Control for emPC-A/iMX6
Platforms: Unknown
Default status: unaffected

Control for emPC-A/iMX6 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

Control for IOT2000

Vendor: CODESYS
Product: Control for IOT2000
Platforms: Unknown
Default status: unaffected

Control for IOT2000 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

Control for PFC100

Vendor: CODESYS
Product: Control for PFC100
Platforms: Unknown
Default status: unaffected

Control for PFC100 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

Control for PFC200

Vendor: CODESYS
Product: Control for PFC200
Platforms: Unknown
Default status: unaffected

Control for PFC200 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

Control for Raspberry Pi

Vendor: CODESYS
Product: Control for Raspberry Pi
Platforms: Unknown
Default status: unaffected

Control for Raspberry Pi · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

Control RTE V3 (all variants)

Vendor: CODESYS
Product: Control RTE V3 (all variants)
Platforms: Unknown
Default status: unaffected

Control RTE V3 (all variants) · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

Control Win V3 (all variants)

Vendor: CODESYS
Product: Control Win V3 (all variants)
Platforms: Unknown
Default status: unaffected

Control Win V3 (all variants) · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

V3 Simulation Runtime (part of the CODESYS Development System)

Vendor: CODESYS
Product: V3 Simulation Runtime (part of the CODESYS Development System)
Platforms: Unknown
Default status: unaffected

V3 Simulation Runtime (part of the CODESYS Development System) · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

HMI V3 (all variants)

Vendor: CODESYS
Product: HMI V3 (all variants)
Platforms: Unknown
Default status: unaffected

HMI V3 (all variants) · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

V3 Remote Target Visu (all variants)

Vendor: CODESYS
Product: V3 Remote Target Visu (all variants)
Platforms: Unknown
Default status: unaffected

V3 Remote Target Visu (all variants) · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

Control V3 Runtime System Toolkit

Vendor: CODESYS
Product: Control V3 Runtime System Toolkit
Platforms: Unknown
Default status: unaffected

Control V3 Runtime System Toolkit · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

V3 Embedded Target Visu Toolkit

Vendor: CODESYS
Product: V3 Embedded Target Visu Toolkit
Platforms: Unknown
Default status: unaffected

V3 Embedded Target Visu Toolkit · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

V3 Remote Target Visu Toolkit

Vendor: CODESYS
Product: V3 Remote Target Visu Toolkit
Platforms: Unknown
Default status: unaffected

V3 Remote Target Visu Toolkit · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.0.0	`affected`	custom	3.5.12.30	Unavailable	None listed

Runtime Toolkit 32 bit embedded

Vendor: CODESYS
Product: Runtime Toolkit 32 bit embedded
Platforms: Unknown
Default status: unaffected

Runtime Toolkit 32 bit embedded · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.0.0.0	`affected`	custom	2.3.2.10	Unavailable	None listed

Runtime Toolkit 32 bit full

Vendor: CODESYS
Product: Runtime Toolkit 32 bit full
Platforms: Unknown
Default status: unaffected

Runtime Toolkit 32 bit full · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.0.0.0	`affected`	custom	2.4.7.52	Unavailable	None listed

Runtime PLCWinNT

Vendor: CODESYS
Product: Runtime PLCWinNT
Platforms: Unknown
Default status: unaffected

Runtime PLCWinNT · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.0.0.0	`affected`	custom	2.4.7.52	Unavailable	None listed