CVE-2018-25048: Codesys Control For Beaglebone

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

Affected products

Codesys Control For Beaglebone: from 3.0.0.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys Control For Empc-a/imx6: from 3.0.0.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys Control For IOT2000: from 3.0.0.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys Control For PFC100: from 3.0.0.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys Control For PFC200: from 3.0.0.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys Control For Raspberry Pi: from 3.0.0.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys Control Rte: from 3.0.0.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys Control v3 Runtime System Toolkit: from 3.0.0.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys Control Win: from 3.0.0.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys Embedded Target Visu Toolkit: from 3.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys HMI: from 3.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys Remote Target Visu Toolkit: from 3.0, before 3.5.12.30 (fixed in 3.5.12.30)
Codesys Runtime Plcwinnt: from 2.0.0.0, before 2.4.7.52 (fixed in 2.4.7.52)
Codesys Runtime System Toolkit: from 2.0.0.0, before 2.4.7.52 (fixed in 2.4.7.52); version 3.5.15.0 only
Codesys Simulation Runtime: from 3.0.0.0, before 3.5.12.30 (fixed in 3.5.12.30)

Published 2023-03-23. Last modified 2026-06-17.