CVE-2012-6069 3S CoDeSys Relative Path Traversal
An attacker can exploit input validation flaws in the file transfer functionality to read or write arbitrary files on the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-6069?
CVE-2012-6069 is a critical path traversal vulnerability in 3S-Smart Software Solutions CECX-X-C1 Modular Master Controller with CoDeSys, published on 21 Jan 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This could allow the attacker to affect the availability, integrity, and confidentiality of the device.
Which versions are affected by CVE-2012-6069?
It affects 1 product.
Products include 3s-Software Codesys Runtime System.
How do I fix CVE-2012-6069?
No fix has been published for CVE-2012-6069 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2012-6069 being exploited?
There is no known exploitation of CVE-2012-6069 in the wild and no public exploit code.
Other vulnerabilities in 3S-Smart Software Solutions CECX-X-C1 Modular Master Controller with CoDeSys
- CVE-2018-5440 Memory corruption in 3S-Smart Software Solutions GmbH CODESYS Web Server
- CVE-2012-6068 3S CoDeSys Improper Access Control
- CVE-2014-0760 Festo CECX-X-(C1/M1) Controller Improper Authentication
- CVE-2014-0769 Festo CECX-X-(C1/M1) Controller Improper Authentication
- CVE-2015-6482 Null dereference in n/a
Sources
Also known as GHSA-6q9j-3828-rfxj.