CVE-2012-6068 - CVE House
Back to Database
Status published Critical CVE-2012-6068

3S CoDeSys Improper Access Control

Vulnerability Description

The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-6068

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Independent researcher Reid Wightman of IOActive, formerly of Digital Bond has validated that the patch, issued by 3S, mitigates theses vulnerabilities.

References

More from 3S-Smart Software Solutions

View All →
CVE-2012-6069
3S CoDeSys Relative Path Traversal
Critical 10

Affected Vendor

3S-Smart Software Solutions

View all reports →

Affected Software

CODESYS Control Runtime embedded, CODESYS Control Runtime full, CODESYS Control RTE, CECX-X-C1 Modular Master Controller with CoDeSys, CECX-X-M1 Modular Controller with CoDeSys and SoftMotion, CoDeSys
Vulnerable Versions:
0, All, 3.X

Timeline

Official Publish: January 21st, 2013
Last Modified: July 2nd, 2025
Added to House: July 19th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-284

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact