CVE-2018-10612
published 2019-01-29CVE-2018-10612: In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled…
PriorityP349critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
1.27%
66.7th percentile
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3s-smart | 3s-smart_software_solutions_gmbh_codesys_control_v3_products_prior_to_version_3 | — | — |
| codesys | control_for_beaglebone_sl | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
| codesys | control_for_empc-a_imx6_sl | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
| codesys | control_for_iot2000_sl | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
| codesys | control_for_linux_sl | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
| codesys | control_for_pfc100_sl | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
| codesys | control_for_pfc200_sl | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
| codesys | control_for_raspberry_pi_sl | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
| codesys | control_rte_sl | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
| codesys | control_runtime_toolkit | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
| codesys | control_win_sl | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
| codesys | development_system_v3 | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
| codesys | hmi_sl | >= 3.0 < 3.5.14.0 | 3.5.14.0 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
CODESYS in Festo Automation Suite
cisa_ics·2026-03-17
CODESYS in Festo Automation Suite
ICS Advisory
##
CODESYS in Festo Automation Suite
Release DateMarch 17, 2026
Alert CodeICSA-26-076-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
3. TECHNICAL DETAILS
The following versions of CODESYS in Festo Automation Suite are affected:
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.5.16.10) vers:all/*
- FESTO Software Festo Automation Suite (2.8.0.137) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation
CISA ICS
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
cisa_ics·2025-11-13
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
ICS Advisory
##
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
Last RevisedNovember 13, 2025
Alert CodeICSA-25-273-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Festo
- Equipment: Controller CECC-S,-LK,-D Family Firmware
- Vulnerabilities: Exposure of Resource to Wrong Sphere, Untrusted Pointer Dereference, NULL Pointer Dereference, Files or Directories Accessible to External Parties, Out-of-bounds Write, Improper Privilege Management, Incorrect Permission Assignment for Critical Resource, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Missing Release of Memory afte
CISA ICS
3S-Smart Software Solutions GmbH CODESYS Control V3 Products
cisa_ics·2018-12-18·CVSS 9.8
[CRITICAL] 3S-Smart Software Solutions GmbH CODESYS Control V3 Products
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
3S-Smart Software Solutions GmbH CODESYS Control V3 Products
Last RevisedDecember 18, 2018
Alert CodeICSA-18-352-03
## 1. EXECUTIVE SUMMARY
-
CVSS v3 9.8
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: 3S-Smart Software Solutions GmbH
- Equipment: CODESYS Control V3 products
- Vulnerability: Improper Access Control
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow unauthorized access and exfiltration of sensitive data including user credentials.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
3S-Smart Software Soluti
GHSA
GHSA-hvp9-xhr6-2xm4: In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3
ghsa_unreviewed·2022-05-13
CVE-2018-10612 [CRITICAL] CWE-311 GHSA-hvp9-xhr6-2xm4: In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-01-29
Published