PT-2012-1188 · 3S Smart Software Solutions · Codesys Runtime System+1

Published 2012-12-05 · Updated 2025-07-02 · CVE-2012-6068

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CODESYS Runtime System versions 2.3.x through 2.4.x

Description The issue is related to the lack of authentication requirements in the default configuration of the CODESYS Runtime Toolkit. This allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service.

Recommendations For versions 2.3.x through 2.4.x, consider implementing authentication requirements for the Runtime Toolkit to prevent unauthorized access. As a temporary workaround, restrict access to the TCP listener service to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-264

CWE-284

Related Identifiers

BDU:2016-02091

BDU:2017-00134

CVE-2012-6068

Affected Products

Codesys Runtime System

Codesys Runtime Toolkit

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2012-6068 · Security Note
• https://bdu.fstec.ru/vul/2016-02091 · Security Note
• http://codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00134 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6068 · Note
• https://us.codesys.com/ecosystem/security · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-13-011-01 · Note
• http://us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf · Note
• https://cisa.gov/news-events/ics-advisories/icsa-14-084-01 · Note
• http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01 · Note
• https://t.me/cvenotify/127498 · Telegram Post
• http://digitalbond.com/tools/basecamp/3s-codesys · Note
• https://cisa.gov/news-events/ics-advisories/icsa-13-011-01 · Note