CVE-2018-10612 Misconfiguration in 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0
Attackers can access devices and sensitive data because user access management and encryption are disabled by default in CODESYS Control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-10612?
CVE-2018-10612 is a critical vulnerability in Codesys Control for Beaglebone Sl, published on 29 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.
Which versions are affected by CVE-2018-10612?
It affects 12 products.
Products include Codesys Control for Beaglebone Sl, Codesys Control for Empc-A\/Imx6 Sl, Codesys Control for Iot2000 Sl, Codesys Control for Linux Sl, Codesys Control for Pfc100 Sl, Codesys Control for Pfc200 Sl and 6 more.
How do I fix CVE-2018-10612?
No fix has been published for CVE-2018-10612 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-10612 being exploited?
There is no known exploitation of CVE-2018-10612 in the wild and no public exploit code.
Other vulnerabilities in Codesys Control for Beaglebone Sl
- CVE-2019-9010 Missing authorization in n/a
- CVE-2023-6357 OS Command Injection in multiple CODESYS products
- CVE-2022-4046 CODESYS: Improper memory restrictions fro CODESYS Control
- CVE-2022-47379 CODESYS: Multiple products prone to out-of-bounds write
- CVE-2022-47380 CODESYS: Multiple products prone to out-of-bounds write
Sources
Also known as GHSA-hvp9-xhr6-2xm4.