PT-2017-16843 · 3S Smart Software Solutions · Codesys Web Server

David Atch · Published 2017-05-19 · Updated 2019-10-09 · CVE-2017-6027

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CODESYS Web Server versions 2.3 and prior

Description An Arbitrary File Upload issue was discovered, allowing a specially crafted web server request to upload arbitrary files to the CODESYS Web Server without authorization, potentially enabling remote code execution.

Recommendations For CODESYS Web Server versions 2.3 and prior, update to a version later than 2.3 to resolve the issue. As a temporary workaround, consider restricting access to the web server to minimize the risk of exploitation.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2017-6027

Affected Products

Codesys Web Server

References · 4

• https://osv.dev/vulnerability/CVE-2017-6027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6027 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-087-02 · Note
• http://securityfocus.com/bid/97174 · Note