CVE-2019-9008
published 2019-09-17CVE-2019-9008: An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.
PriorityP347high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.86%
76.8th percentile
An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codesys | control_for_beaglebone | < 3.5.13.0 | 3.5.13.0 |
| codesys | control_for_empc-a_imx6 | < 3.5.13.0 | 3.5.13.0 |
| codesys | control_for_iot2000 | < 3.5.13.0 | 3.5.13.0 |
| codesys | control_for_pfc100 | < 3.5.13.0 | 3.5.13.0 |
| codesys | control_for_pfc200 | < 3.5.13.0 | 3.5.13.0 |
| codesys | control_for_raspberry_pi | < 3.5.13.0 | 3.5.13.0 |
| codesys | control_rte | < 3.5.13.0 | 3.5.13.0 |
| codesys | control_win | < 3.5.13.0 | 3.5.13.0 |
| codesys | hmi | < 3.5.13.0 | 3.5.13.0 |
| codesys | simulation_runtime | < 3.5.13.0 | 3.5.13.0 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
CODESYS in Festo Automation Suite
cisa_ics·2026-03-17
CODESYS in Festo Automation Suite
ICS Advisory
##
CODESYS in Festo Automation Suite
Release DateMarch 17, 2026
Alert CodeICSA-26-076-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
3. TECHNICAL DETAILS
The following versions of CODESYS in Festo Automation Suite are affected:
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.5.16.10) vers:all/*
- FESTO Software Festo Automation Suite (2.8.0.137) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation
CISA ICS
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
cisa_ics·2025-11-13
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
ICS Advisory
##
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
Last RevisedNovember 13, 2025
Alert CodeICSA-25-273-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Festo
- Equipment: Controller CECC-S,-LK,-D Family Firmware
- Vulnerabilities: Exposure of Resource to Wrong Sphere, Untrusted Pointer Dereference, NULL Pointer Dereference, Files or Directories Accessible to External Parties, Out-of-bounds Write, Improper Privilege Management, Incorrect Permission Assignment for Critical Resource, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Missing Release of Memory afte
CISA ICS
3S-Smart Software Solutions GmbH CODESYS Control V3 Online User Management
cisa_ics·2019-09-12·CVSS 8.8
[HIGH] 3S-Smart Software Solutions GmbH CODESYS Control V3 Online User Management
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
3S-Smart Software Solutions GmbH CODESYS Control V3 Online User Management
Last RevisedSeptember 12, 2019
Alert CodeICSA-19-255-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.8
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: 3S-Smart Software Solutions GmbH
- Equipment: CODESYS Control V3 online user management
- Vulnerability: Incorrect Permission Assignment for Critical Resource
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow unauthorized actors access to unintended functionality and/or information.
## 3. TECHNICAL DETAILS
GHSA
GHSA-8hg6-g75q-4x9v: An issue was discovered in 3S-Smart CODESYS V3 through 3
ghsa_unreviewed·2022-05-24
CVE-2019-9008 [MEDIUM] CWE-732 GHSA-8hg6-g75q-4x9v: An issue was discovered in 3S-Smart CODESYS V3 through 3
An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12939&token=5b93f0d95a68ff7461d2c249d8da00f16b8f9987&download=https://www.codesys.com/https://www.us-cert.gov/ics/advisories/icsa-19-255-03https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12939&token=5b93f0d95a68ff7461d2c249d8da00f16b8f9987&download=https://www.codesys.com/https://www.us-cert.gov/ics/advisories/icsa-19-255-03
2019-09-17
Published