{"id":"CVE-2012-6069","aliases":["EUVD-2012-5943","GHSA-6q9j-3828-rfxj"],"status":"published","title":"3S CoDeSys Relative Path Traversal","description":"The CoDeSys Runtime Toolkit’s file transfer functionality does not \nperform input validation, which allows an attacker to access files and \ndirectories outside the intended scope. This may allow an attacker to \nupload and download any file on the device. This could allow the \nattacker to affect the availability, integrity, and confidentiality of \nthe device.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02637,"percentile":0.85663,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-23"],"published":"2013-01-21T21:00:00Z","modified":"2026-06-16T23:47:45Z","products":[{"vendor":"3s-smart software solutions","product":"codesys"},{"vendor":"3s-smart software solutions","product":"codesys control rte"},{"vendor":"3s-smart software solutions","product":"codesys control runtime embedded"},{"vendor":"3s-smart software solutions","product":"codesys control runtime full"},{"vendor":"3s-software","product":"codesys_runtime_system"},{"vendor":"festo","product":"cecx-x-c1 modular master controller with codesys"},{"vendor":"festo","product":"cecx-x-m1 modular controller with codesys and softmotion"}],"references":[{"url":"http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01"},{"url":"http://www.digitalbond.com/tools/basecamp/3s-codesys/","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01"},{"url":"https://us.codesys.com/ecosystem/security/"},{"url":"http://www.securityfocus.com/bid/56300","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01","tags":["x_refsource_MISC","x_transferred","US Government Resource"]},{"url":"http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf","tags":["x_refsource_MISC","x_transferred","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6069"},{"url":"http://www.digitalbond.com/tools/basecamp/3s-codesys"},{"url":"https://us.codesys.com/ecosystem/security"},{"url":"https://github.com/advisories/GHSA-6q9j-3828-rfxj"}],"sources":{"cve":[{"id":"CVE-2012-6069","title":"3S CoDeSys Relative Path Traversal","description":"The CoDeSys Runtime Toolkit’s file transfer functionality does not \nperform input validation, which allows an attacker to access files and \ndirectories outside the intended scope. This may allow an attacker to \nupload and download any file on the device. This could allow the \nattacker to affect the availability, integrity, and confidentiality of \nthe device.","status":"published","published":"2013-01-21T21:00:00Z","modified":"2025-07-02T20:15:19.655Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:34:51.269982Z"}],"euvd":[{"id":"EUVD-2012-5943","description":"The CoDeSys Runtime Toolkit’s file transfer functionality does not \nperform input validation, which allows an attacker to access files and \ndirectories outside the intended scope. This may allow an attacker to \nupload and download any file on the device. This could allow the \nattacker to affect the availability, integrity, and confidentiality of \nthe device.","status":"published","published":"2013-01-21T21:00:00Z","modified":"2025-07-02T20:15:19Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:14.284181Z"}],"ghsa":[{"id":"GHSA-6q9j-3828-rfxj","title":"Directory traversal vulnerability in the Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4...","description":"Directory traversal vulnerability in the Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x allows remote attackers to read, overwrite, or create arbitrary files via a .. (dot dot) in a request to the TCP listener service.","status":"published","published":"2022-05-17T04:04:57Z","modified":"2025-07-02T21:32:57Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T15:02:53.892162Z"}],"nvd":[{"id":"CVE-2012-6069","description":"The CoDeSys Runtime Toolkit’s file transfer functionality does not \nperform input validation, which allows an attacker to access files and \ndirectories outside the intended scope. This may allow an attacker to \nupload and download any file on the device. This could allow the \nattacker to affect the availability, integrity, and confidentiality of \nthe device.","status":"published","published":"2013-01-21T21:55:01.15Z","modified":"2026-06-16T23:47:45.993Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-23","CWE-22"],"updated_at":"2026-11-02T14:02:16.958223Z"}]}}