Vendor
3s Software
Products
3
CVEs
12
Across products
99
Status
Private
Products
3- 85 CVEs
- 13 CVEs
- 1 CVE
Recent CVEs
12| CVE | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2012-6069 | Cri | 0.65 | 10.0 | 0.02 | Jan 21, 2013 | The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This could allow the attacker to affect the availability, integrity, and confidentiality of the device. | |
| CVE-2012-6068 | Cri | 0.64 | 9.8 | 0.04 | Jan 21, 2013 | The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service. | |
| CVE-2012-4705 | 0.09 | — | 0.70 | Feb 24, 2013 | Directory traversal vulnerability in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors involving a crafted pathname. | ||
| CVE-2012-4708 | 0.01 | — | 0.07 | Feb 24, 2013 | Stack-based buffer overflow in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted packet. | ||
| CVE-2012-4707 | 0.01 | — | 0.07 | Feb 24, 2013 | 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors that trigger an out-of-bounds memory access. | ||
| CVE-2012-4704 | 0.01 | — | 0.12 | Feb 24, 2013 | Array index error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted packet. | ||
| CVE-2015-6482 | 0.00 | — | 0.00 | Oct 18, 2015 | Runtime Toolkit before 2.4.7.48 in 3S-Smart CODESYS before 2.3.9.48 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted request. | ||
| CVE-2014-0769 | 0.00 | — | 0.01 | Apr 25, 2014 | The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001. | ||
| CVE-2014-0760 | 0.00 | — | 0.03 | Apr 25, 2014 | The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. | ||
| CVE-2014-0757 | 0.00 | — | 0.02 | Jan 31, 2014 | Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. | ||
| CVE-2013-2781 | 0.00 | — | 0.03 | May 23, 2013 | Use-after-free vulnerability in the server application in 3S CODESYS Gateway 2.3.9.27 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via unspecified vectors. | ||
| CVE-2012-4706 | 0.00 | — | 0.01 | Feb 24, 2013 | Integer signedness error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to cause a denial of service via a crafted packet that triggers a heap-based buffer overflow. |