Codesys Runtime System Toolkit vulnerabilities

3 CVEs affecting Codesys Runtime System Toolkit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-25048, published 2023-03-23.

More from Codesys.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-9009, published 2019-09-17. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.
• CVE-2019-13542, published 2019-09-17. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. 3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA client that cause a NULL pointer…
• CVE-2018-25048, published 2023-03-23. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.