Sign-up

ID

VAR-201901-0452


CVE

CVE-2018-10612


TITLE

3S-Smart Software Solutions GmbH CODESYS Control V3 Access control vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2018-014602

DESCRIPTION

In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials. 3S-Smart CODESYS Control for BeagleBone, etc. are all German 3S-Smart Software Solutions company's programming software for industrial control system development. The following products and versions are affected: 3S-Smart CODESYS Control for BeagleBone, CODESYS Control for emPC-A / iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (part of CODESYS setup), CODESYS V3 Simulation Runtime (part of CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. Successful exploitation may aid in launching further attacks

Trust: 2.52

sources: NVD: CVE-2018-10612 // JVNDB: JVNDB-2018-014602 // CNNVD: CNNVD-201812-788 // BID: 106248 // VULMON: CVE-2018-10612

AFFECTED PRODUCTS

vendor:codesysmodel:control for empc-a\/imx6 slscope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:control for pfc100 slscope:ltversion:3.5.14.0

Trust: 1.0

vendor:codesysmodel:control for beaglebone slscope:ltversion:3.5.14.0

Trust: 1.0

vendor:codesysmodel:control rte slscope:ltversion:3.5.14.0

Trust: 1.0

vendor:codesysmodel:control runtime toolkitscope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:control for raspberry pi slscope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:development system v3scope:ltversion:3.5.14.0

Trust: 1.0

vendor:codesysmodel:hmi slscope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:control for empc-a\/imx6 slscope:ltversion:3.5.14.0

Trust: 1.0

vendor:codesysmodel:control for pfc100 slscope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:control for beaglebone slscope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:control for linux slscope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:control for iot2000 slscope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:control for pfc200 slscope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:control runtime toolkitscope:ltversion:3.5.14.0

Trust: 1.0

vendor:codesysmodel:control rte slscope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:control for raspberry pi slscope:ltversion:3.5.14.0

Trust: 1.0

vendor:codesysmodel:development system v3scope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:hmi slscope:ltversion:3.5.14.0

Trust: 1.0

vendor:codesysmodel:control win slscope:ltversion:3.5.14.0

Trust: 1.0

vendor:codesysmodel:control for linux slscope:ltversion:3.5.14.0

Trust: 1.0

vendor:codesysmodel:control win slscope:gteversion:3.0

Trust: 1.0

vendor:codesysmodel:control for iot2000 slscope:ltversion:3.5.14.0

Trust: 1.0

vendor:codesysmodel:control for pfc200 slscope:ltversion:3.5.14.0

Trust: 1.0

vendor:3s smartmodel:codesys control for beaglebonescope:ltversion:3.5.14.0

Trust: 0.8

vendor:3s smartmodel:codesys control for empc-a/imx6scope:ltversion:3.5.14.0

Trust: 0.8

vendor:3s smartmodel:codesys control for iot2000scope:ltversion:3.5.14.0

Trust: 0.8

vendor:3s smartmodel:codesys control for linuxscope:ltversion:3.5.14.0

Trust: 0.8

vendor:3s smartmodel:codesys control for pfc100scope:ltversion:3.5.14.0

Trust: 0.8

vendor:3s smartmodel:codesys control for pfc200scope:ltversion:3.5.14.0

Trust: 0.8

vendor:3s smartmodel:codesys control for raspberry piscope:ltversion:3.5.14.0

Trust: 0.8

vendor:3s smartmodel:codesys control rte v3scope:ltversion:3.5.14.0

Trust: 0.8

vendor:3s smartmodel:codesys control runtime toolkitscope:ltversion:3.5.14.0

Trust: 0.8

vendor:3s smartmodel:codesys control win slscope:ltversion:3.5.14.0

Trust: 0.8

vendor:3smodel:codesys simulation runtimescope:eqversion:v30

Trust: 0.3

vendor:3smodel:codesys hmiscope:eqversion:3

Trust: 0.3

vendor:3smodel:codesys control runtime system toolkitscope:eqversion:v30

Trust: 0.3

vendor:3smodel:codesys control rtescope:eqversion:3

Trust: 0.3

vendor:3smodel:codesys control for raspberry piscope:eqversion:0

Trust: 0.3

vendor:3smodel:codesys control for pfc200scope:eqversion:0

Trust: 0.3

vendor:3smodel:codesys control for pfc100scope:eqversion:0

Trust: 0.3

vendor:3smodel:codesys control for linuxscope:eqversion:0

Trust: 0.3

vendor:3smodel:codesys control for iot2000scope:eqversion:0

Trust: 0.3

vendor:3smodel:codesys control for empc-a/imx6scope:eqversion:0

Trust: 0.3

vendor:3smodel:codesys control for beaglebonescope:eqversion:0

Trust: 0.3

vendor:3smodel:codesys controlscope:neversion:v33.5.14.0

Trust: 0.3

sources: BID: 106248 // JVNDB: JVNDB-2018-014602 // NVD: CVE-2018-10612

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-10612
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-10612
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201812-788
value: CRITICAL

Trust: 0.6

VULMON: CVE-2018-10612
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-10612
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2018-10612
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULMON: CVE-2018-10612 // JVNDB: JVNDB-2018-014602 // CNNVD: CNNVD-201812-788 // NVD: CVE-2018-10612

PROBLEMTYPE DATA

problemtype:CWE-284

Trust: 1.8

problemtype:CWE-311

Trust: 1.0

problemtype:CWE-732

Trust: 1.0

sources: JVNDB: JVNDB-2018-014602 // NVD: CVE-2018-10612

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201812-788

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201812-788

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-014602

PATCH
title:Top Pageurl:https://www.codesys.com/
Trust: 0.8
title:Multiple 3S-Smart Software Solutions Product access control error vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=87999
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-014602 // 
            
            
            
            CNNVD: CNNVD-201812-788

EXTERNAL IDS
db:ICS CERTid:ICSA-18-352-03
Trust: 2.8
db:NVDid:CVE-2018-10612
Trust: 2.8
db:BIDid:106248
Trust: 2.0
db:JVNDBid:JVNDB-2018-014602
Trust: 0.8
db:CNNVDid:CNNVD-201812-788
Trust: 0.6
db:VULMONid:CVE-2018-10612
Trust: 0.1
sources:
            
            
            VULMON: CVE-2018-10612 // 
            
            
            
            BID: 106248 // 
            
            
            
            JVNDB: JVNDB-2018-014602 // 
            
            
            
            CNNVD: CNNVD-201812-788 // 
            
            
            
            NVD: CVE-2018-10612

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-18-352-03
Trust: 2.9
url:http://www.securityfocus.com/bid/106248
Trust: 2.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-10612
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-10612
Trust: 0.8
url:https://www.codesys.com/
Trust: 0.3
url:https://customers.codesys.com/fileadmin/data/customers/security/codesys-security-whitepaper.pdf
Trust: 0.3
url:https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-035-codesys-control-v3-access-control-inactive-by-default/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/311.html
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/732.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULMON: CVE-2018-10612 // 
            
            
            
            BID: 106248 // 
            
            
            
            JVNDB: JVNDB-2018-014602 // 
            
            
            
            CNNVD: CNNVD-201812-788 // 
            
            
            
            NVD: CVE-2018-10612

CREDITS
Yury Serdyuk of Kaspersky Lab
Trust: 0.3
sources:
            
            
            BID: 106248

SOURCES
db:VULMONid:CVE-2018-10612
db:BIDid:106248
db:JVNDBid:JVNDB-2018-014602
db:CNNVDid:CNNVD-201812-788
db:NVDid:CVE-2018-10612

LAST UPDATE DATE
2024-11-23T22:58:47.443000+00:00

SOURCES UPDATE DATE
db:VULMONid:CVE-2018-10612date:2019-10-09T00:00:00
db:BIDid:106248date:2018-12-18T00:00:00
db:JVNDBid:JVNDB-2018-014602date:2019-03-29T00:00:00
db:CNNVDid:CNNVD-201812-788date:2019-10-17T00:00:00
db:NVDid:CVE-2018-10612date:2024-11-21T03:41:39.853

SOURCES RELEASE DATE
db:VULMONid:CVE-2018-10612date:2019-01-29T00:00:00
db:BIDid:106248date:2018-12-18T00:00:00
db:JVNDBid:JVNDB-2018-014602date:2019-03-29T00:00:00
db:CNNVDid:CNNVD-201812-788date:2018-12-19T00:00:00
db:NVDid:CVE-2018-10612date:2019-01-29T16:29:00.247