CVE-2012-6069: 3S CoDeSys Relative Path Traversal

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-01-21 · updated 2026-06-16
Weakness: CWE-23

Description

The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This could allow the attacker to affect the availability, integrity, and confidentiality of the device.

Affected products

3S-Software Codesys Runtime System: 2.4.0, 2.3.9.8, 2.3.9.35, 2.3.9.36, 2.3.9.37

References

http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html
http://www.digitalbond.com/tools/basecamp/3s-codesys/
https://us.codesys.com/ecosystem/security/
https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01
https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01
http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01
http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html
http://www.digitalbond.com/tools/basecamp/3s-codesys/
http://www.securityfocus.com/bid/56300
http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf

Get alerted when CVE-2012-6069 or the next vulnerability affects your stack