CVE-2018-25048

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
CODESYSControl for BeagleBone>= 3.0.0.0, < 3.5.12.30
CODESYS Control for emPC-A/iMX6>= 3.0.0.0, < 3.5.12.30
CODESYSControl for IOT2000>= 3.0.0.0, < 3.5.12.30
CODESYSControl for PFC100>= 3.0.0.0, < 3.5.12.30
CODESYSControl for PFC200>= 3.0.0.0, < 3.5.12.30
CODESYSControl for Raspberry Pi>= 3.0.0.0, < 3.5.12.30
CODESYSControl RTE V3 (all variants)>= 3.0.0.0, < 3.5.12.30
CODESYSControl Win V3 (all variants)>= 3.0.0.0, < 3.5.12.30
CODESYSV3 Simulation Runtime (part of the CODESYS Development System)>= 3.0.0.0, < 3.5.12.30
CODESYSHMI V3 (all variants)>= 3.0.0.0, < 3.5.12.30
CODESYSV3 Remote Target Visu (all variants)>= 3.0.0.0, < 3.5.12.30
CODESYSControl V3 Runtime System Toolkit>= 3.0.0.0, < 3.5.12.30
CODESYSV3 Embedded Target Visu Toolkit>= 3.0.0.0, < 3.5.12.30
CODESYSV3 Remote Target Visu Toolkit>= 3.0.0.0, < 3.5.12.30
CODESYSRuntime Toolkit 32 bit embedded>= 2.0.0.0, < 2.3.2.10
CODESYSRuntime Toolkit 32 bit full>= 2.0.0.0, < 2.4.7.52
CODESYSRuntime PLCWinNT>= 2.0.0.0, < 2.4.7.52

References

Timeline

Published
Mar 23, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-250497.5A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the CVE-2018-25056.1SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts thaCVE-2018-250506.1A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function ACVE-2018-250516.1A vulnerability, which was classified as problematic, was found in JmPotato Pomash. This affects an unknown part of the file Pomash/theme/clCVE-2018-250526.1A vulnerability has been found in Catalyst-Plugin-Session up to 0.40 and classified as problematic. This vulnerability affects the function CVE-2018-250536.1A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the fCVE-2018-250545.4A vulnerability was found in shred cilla. It has been classified as problematic. Affected is an unknown function of the file cilla-xample/srCVE-2018-250556.1A vulnerability was found in FarCry Solr Pro Plugin up to 1.5.x. It has been declared as problematic. Affected by this vulnerability is an uCVE-2018-250566.1A vulnerability, which was classified as problematic, was found in yolapi. Affected is the function render_description of the file yolapi/pyCVE-2018-250579.8A vulnerability was found in simple_php_link_shortener. It has been classified as critical. Affected is an unknown function of the file indeCVE-2018-250586.1A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twiCVE-2018-250595.3A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic. Affected by this issue is the function pasteHandler of th
CVE-2018-25048: High severity, CVSS 8.8 | Vulnix