CVE-2019-9013
published 2019-08-15CVE-2019-9013: An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being…
PriorityP342high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.30%
22.3th percentile
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codesys | control_for_beaglebone_sl | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
| codesys | control_for_empc-a_imx6_sl | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
| codesys | control_for_iot2000_sl | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
| codesys | control_for_linux_sl | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
| codesys | control_for_pfc100_sl | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
| codesys | control_for_pfc200_sl | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
| codesys | control_rte_sl | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
| codesys | control_win_sl | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
| codesys | development_system | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
| codesys | hmi_sl | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
| codesys | raspberry_pi | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
| codesys | runtime_toolkit | >= 3.0 < 3.5.16.0 | 3.5.16.0 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.8MEDIUMAV:A/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
CODESYS in Festo Automation Suite
cisa_ics·2026-03-17
CODESYS in Festo Automation Suite
ICS Advisory
##
CODESYS in Festo Automation Suite
Release DateMarch 17, 2026
Alert CodeICSA-26-076-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
3. TECHNICAL DETAILS
The following versions of CODESYS in Festo Automation Suite are affected:
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.5.16.10) vers:all/*
- FESTO Software Festo Automation Suite (2.8.0.137) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation
CISA ICS
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
cisa_ics·2025-11-13
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
ICS Advisory
##
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
Last RevisedNovember 13, 2025
Alert CodeICSA-25-273-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Festo
- Equipment: Controller CECC-S,-LK,-D Family Firmware
- Vulnerabilities: Exposure of Resource to Wrong Sphere, Untrusted Pointer Dereference, NULL Pointer Dereference, Files or Directories Accessible to External Parties, Out-of-bounds Write, Improper Privilege Management, Incorrect Permission Assignment for Critical Resource, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Missing Release of Memory afte
CISA ICS
3S-Smart Software Solutions GmbH CODESYS V3 (Update A)
cisa_ics·2019-08-01·CVSS 8.8
[HIGH] 3S-Smart Software Solutions GmbH CODESYS V3 (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
3S-Smart Software Solutions GmbH CODESYS V3 (Update A)
Last RevisedMay 14, 2020
Alert CodeICSA-19-213-04
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.8
- ATTENTION: Low skill level to exploit
- Vendor: 3S-Smart Software Solutions GmbH
- Equipment: CODESYS V3
- Vulnerability: Insufficiently Protected Credentials
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-19-213-04 3S-Smart Software Solutions GmbH CODESYS V3 that was published August 1, 2019, to the ICS webpage on us-cert.gov.
## 3. RISK EVALUATION
Successful exploitation of t
GHSA
GHSA-h9jc-6jhq-r45q: An issue was discovered in 3S-Smart CODESYS V3 products
ghsa_unreviewed·2022-05-24
CVE-2019-9013 [HIGH] CWE-327 GHSA-h9jc-6jhq-r45q: An issue was discovered in 3S-Smart CODESYS V3 products
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download=https://www.us-cert.gov/ics/advisories/icsa-19-213-04https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download=https://www.us-cert.gov/ics/advisories/icsa-19-213-04
2019-08-15
Published