{"api_version":"1","generated_at":"2026-05-15T00:24:26+00:00","cve":"CVE-2012-6069","urls":{"html":"https://cve.report/CVE-2012-6069","api":"https://cve.report/api/cve/CVE-2012-6069.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-6069","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-6069"},"summary":{"title":"3S CoDeSys Relative Path Traversal","description":"The CoDeSys Runtime Toolkit’s file transfer functionality does not \nperform input validation, which allows an attacker to access files and \ndirectories outside the intended scope. This may allow an attacker to \nupload and download any file on the device. This could allow the \nattacker to affect the availability, integrity, and confidentiality of \nthe device.","state":"PUBLISHED","assigner":"icscert","published_at":"2013-01-21 21:55:01","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-23","CWE-22","CWE-23 CWE-23"],"metrics":[{"version":"3.1","source":"ics-cert@hq.dhs.gov","type":"Secondary","score":"10","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"10","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"10","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf","name":"http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"404 - File Not Found | CISA","mime":"application/pdf","httpstatus":"404","archivestatus":"200"},{"url":"http://www.digitalbond.com/tools/basecamp/3s-codesys/","name":"http://www.digitalbond.com/tools/basecamp/3s-codesys/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Project Basecamp 3S CoDeSys Vulns and Tools","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/56300","name":"http://www.securityfocus.com/bid/56300","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CoDeSys CVE-2012-6069 Directory Traversal Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html","name":"http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Detail","mime":"text/xml","httpstatus":"404","archivestatus":"200"},{"url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01","name":"http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"Festo CECX-X-(C1/M1) Controller Vulnerabilities | ICS-CERT","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01","name":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01","refsource":"ics-cert@hq.dhs.gov","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01","name":"https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01","refsource":"ics-cert@hq.dhs.gov","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://us.codesys.com/ecosystem/security/","name":"https://us.codesys.com/ecosystem/security/","refsource":"ics-cert@hq.dhs.gov","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6069","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6069","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"3S-Smart Software Solutions","product":"CODESYS Control Runtime embedded","version":"affected 2.3.2.8 custom","platforms":[]},{"source":"CNA","vendor":"3S-Smart Software Solutions","product":"CODESYS Control Runtime full","version":"affected 2.4.7.40 custom","platforms":[]},{"source":"CNA","vendor":"3S-Smart Software Solutions","product":"CODESYS Control RTE","version":"affected 2.3.7.17 custom","platforms":[]},{"source":"CNA","vendor":"Festo","product":"CECX-X-C1 Modular Master Controller with CoDeSys","version":"affected All","platforms":[]},{"source":"CNA","vendor":"Festo","product":"CECX-X-M1 Modular Controller with CoDeSys and SoftMotion","version":"affected All","platforms":[]},{"source":"CNA","vendor":"3S-Smart Software Solutions","product":"CoDeSys","version":"unaffected 3.X","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"CoDeSys recommends upgrading to the latest version, which is Version 3. It can be downloaded  here https://store.codesys.com/engineering/codesys.html .3S released a patch which implements a password for authentication to the device.\n\nThe patch can be downloaded from the  CoDeSys Download Center http://www.codesys.com/download.html .\n\nCoDeSys Version 3.X is not affected by these vulnerabilities.","time":"","lang":"en"}],"workarounds":[{"source":"CNA","title":"","value":"3S also recommends the usage of standard security methods like firewalls\n or virtual private network (VPN) access to prevent unauthorized access \nto the controller.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Independent researcher Reid Wightman of IOActive, formerly of Digital Bond has validated that the patch, issued by 3S, mitigates theses vulnerabilities.","lang":"en"}],"nvd_cpes":[{"cve_year":"2012","cve_id":"6069","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"3s-software","cpe5":"codesys_runtime_system","cpe6":"2.3.9.35","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"6069","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"3s-software","cpe5":"codesys_runtime_system","cpe6":"2.3.9.36","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"6069","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"3s-software","cpe5":"codesys_runtime_system","cpe6":"2.3.9.37","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"6069","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"3s-software","cpe5":"codesys_runtime_system","cpe6":"2.3.9.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"6069","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"3s-software","cpe5":"codesys_runtime_system","cpe6":"2.4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T21:21:28.402Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"56300","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/56300"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.digitalbond.com/tools/basecamp/3s-codesys/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"CODESYS Control Runtime embedded","vendor":"3S-Smart Software Solutions","versions":[{"lessThan":"2.3.2.8","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"CODESYS Control Runtime full","vendor":"3S-Smart Software Solutions","versions":[{"lessThan":"2.4.7.40","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"CODESYS Control RTE","vendor":"3S-Smart Software Solutions","versions":[{"lessThan":"2.3.7.17","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"CECX-X-C1 Modular Master Controller with CoDeSys","vendor":"Festo","versions":[{"status":"affected","version":"All"}]},{"defaultStatus":"unaffected","product":"CECX-X-M1 Modular Controller with CoDeSys and SoftMotion","vendor":"Festo","versions":[{"status":"affected","version":"All"}]},{"defaultStatus":"unaffected","product":"CoDeSys","vendor":"3S-Smart Software Solutions","versions":[{"status":"unaffected","version":"3.X"}]}],"credits":[{"lang":"en","type":"finder","value":"Independent researcher Reid Wightman of IOActive, formerly of Digital Bond has validated that the patch, issued by 3S, mitigates theses vulnerabilities."}],"datePublic":"2012-10-31T06:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>\nThe CoDeSys Runtime Toolkit’s file transfer functionality does not \nperform input validation, which allows an attacker to access files and \ndirectories outside the intended scope. This may allow an attacker to \nupload and download any file on the device. This could allow the \nattacker to affect the availability, integrity, and confidentiality of \nthe device.\n\n</p>"}],"value":"The CoDeSys Runtime Toolkit’s file transfer functionality does not \nperform input validation, which allows an attacker to access files and \ndirectories outside the intended scope. This may allow an attacker to \nupload and download any file on the device. This could allow the \nattacker to affect the availability, integrity, and confidentiality of \nthe device."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-23","description":"CWE-23","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-07-02T20:15:19.655Z","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","shortName":"icscert"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01"},{"tags":["x_refsource_MISC"],"url":"http://www.digitalbond.com/tools/basecamp/3s-codesys/"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01"},{"url":"https://us.codesys.com/ecosystem/security/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"CoDeSys recommends upgrading to the latest version, which is Version 3. It can be downloaded <a target=\"_blank\" rel=\"nofollow\" href=\"https://store.codesys.com/engineering/codesys.html?___store=en#All%20versions\">here</a>.<p>3S released a patch which implements a password for authentication to the device.</p><p>The patch can be downloaded from the <a target=\"_blank\" rel=\"nofollow\" href=\"http://www.codesys.com/download.html\">CoDeSys Download Center</a>.</p>CoDeSys Version 3.X is not affected by these vulnerabilities.\n\n<br>"}],"value":"CoDeSys recommends upgrading to the latest version, which is Version 3. It can be downloaded  here https://store.codesys.com/engineering/codesys.html .3S released a patch which implements a password for authentication to the device.\n\nThe patch can be downloaded from the  CoDeSys Download Center http://www.codesys.com/download.html .\n\nCoDeSys Version 3.X is not affected by these vulnerabilities."}],"source":{"advisory":"ICSA-13-011-01","discovery":"EXTERNAL"},"title":"3S CoDeSys Relative Path Traversal","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"3S also recommends the usage of standard security methods like firewalls\n or virtual private network (VPN) access to prevent unauthorized access \nto the controller.\n\n<br>"}],"value":"3S also recommends the usage of standard security methods like firewalls\n or virtual private network (VPN) access to prevent unauthorized access \nto the controller."}],"x_generator":{"engine":"Vulnogram 0.2.0"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","ID":"CVE-2012-6068","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to (1) execute commands via the command-line interface in the TCP listener service or (2) transfer files via requests to the TCP listener service."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html","refsource":"CONFIRM","url":"http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html"},{"name":"http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01","refsource":"MISC","url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01"},{"name":"http://www.digitalbond.com/tools/basecamp/3s-codesys/","refsource":"MISC","url":"http://www.digitalbond.com/tools/basecamp/3s-codesys/"},{"name":"http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf","refsource":"MISC","url":"http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf"}]}}}},"cveMetadata":{"assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","assignerShortName":"icscert","cveId":"CVE-2012-6069","datePublished":"2013-01-21T21:00:00.000Z","dateReserved":"2012-12-05T00:00:00.000Z","dateUpdated":"2025-07-02T20:15:19.655Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-01-21 21:55:01","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-23","CWE-22","CWE-23 CWE-23"],"metrics":{"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:3s-software:codesys_runtime_system:2.4.0:*:*:*:*:*:*:*","matchCriteriaId":"89253C44-34F0-457C-9EEE-E7028F737E02"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:3s-software:codesys_runtime_system:2.3.9.8:*:*:*:*:*:*:*","matchCriteriaId":"CFAB8128-4A70-44CA-A4D3-C859010C8BFF"},{"vulnerable":true,"criteria":"cpe:2.3:a:3s-software:codesys_runtime_system:2.3.9.35:*:*:*:*:*:*:*","matchCriteriaId":"0B99BA40-647D-4203-A003-CAEEF776EF77"},{"vulnerable":true,"criteria":"cpe:2.3:a:3s-software:codesys_runtime_system:2.3.9.36:*:*:*:*:*:*:*","matchCriteriaId":"50443443-14B4-4245-BBE3-C5E451739EF0"},{"vulnerable":true,"criteria":"cpe:2.3:a:3s-software:codesys_runtime_system:2.3.9.37:*:*:*:*:*:*:*","matchCriteriaId":"44C690B5-EE5B-4504-B40D-879F757C8029"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"6069","Ordinal":"1","Title":"3S CoDeSys Relative Path Traversal","CVE":"CVE-2012-6069","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"6069","Ordinal":"1","NoteData":"The CoDeSys Runtime Toolkit’s file transfer functionality does not \nperform input validation, which allows an attacker to access files and \ndirectories outside the intended scope. This may allow an attacker to \nupload and download any file on the device. This could allow the \nattacker to affect the availability, integrity, and confidentiality of \nthe device.","Type":"Description","Title":"3S CoDeSys Relative Path Traversal"},{"CveYear":"2012","CveId":"6069","Ordinal":"2","NoteData":"2013-01-21","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"6069","Ordinal":"3","NoteData":"2015-05-12","Type":"Other","Title":"Modified"}]}}}