3S-Smart Software Solutions GmbH CODESYS ICSA-18-352-03 Access Bypass Vulnerability

BID:106248

CVE-2018-10612 |

Info

3S-Smart Software Solutions GmbH CODESYS ICSA-18-352-03 Access Bypass Vulnerability

Bugtraq ID: 106248
Class: Access Validation Error
CVE: CVE-2018-10612
Remote: Yes
Local: No
Published: Dec 18 2018 12:00AM
Updated: Dec 18 2018 12:00AM
Credit: Yury Serdyuk of Kaspersky Lab
Vulnerable: 3S-Software CODESYS V3 Simulation Runtime 0
3S-Software CODESYS HMI 3
3S-Software CODESYS Control V3 Runtime System Toolkit 0
3S-Software CODESYS Control RTE 3
3S-Software CODESYS Control for Raspberry Pi 0
3S-Software CODESYS Control for PFC200 0
3S-Software CODESYS Control for PFC100 0
3S-Software CODESYS Control for Linux 0
3S-Software CODESYS Control for IOT2000 0
3S-Software CODESYS Control for emPC-A/iMX6 0
3S-Software CODESYS Control for BeagleBone 0
Not Vulnerable: 3S-Software CODESYS Control V3 3.5.14.0

Discussion

3S-Smart Software Solutions GmbH CODESYS ICSA-18-352-03 Access Bypass Vulnerability

3S-Smart Software Solutions GmbH CODESYS is prone to an access bypass vulnerability because it fails to properly validate required user access permissions.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. Successful exploitation may aid in launching further attacks.

3S-Smart Software Solutions GmbH CODESYS Control V3 products containing the CmpSecureChannel or CmpUserMgr components prior to 3.5.14.0 of the following products are vulnerable:

Control for BeagleBone,
CODESYS Control for BeagleBone,
CODESYS Control for emPC-A/iMX6,
CODESYS Control for IOT2000,
CODESYS Control for Linux,
CODESYS Control for PFC100,
CODESYS Control for PFC200,
CODESYS Control for Raspberry Pi,
CODESYS Control RTE V3,
CODESYS Control RTE V3 (for Beckhoff CX),
CODESYS Control Win V3 (also part of the CODESYS setup),
CODESYS V3 Simulation Runtime (part of the CODESYS Development System),
CODESYS Control V3 Runtime System Toolkit, and
CODESYS HMI V3.

Exploit / POC

3S-Smart Software Solutions GmbH CODESYS ICSA-18-352-03 Access Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

3S-Smart Software Solutions GmbH CODESYS ICSA-18-352-03 Access Bypass Vulnerability

Solution:
Updates are available; please see the references for more information.

References

3S-Smart Software Solutions GmbH CODESYS ICSA-18-352-03 Access Bypass Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report