Codesys Control v3 Runtime System Toolkit vulnerabilities

2 CVEs affecting Codesys Control v3 Runtime System Toolkit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-25048, published 2023-03-23.

More from Codesys.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-25048, published 2023-03-23. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.
• CVE-2020-12069, published 2022-12-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can…