CVE-2019-13532

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

3.18%

Published

Sep 13, 2019

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22CWE-22

Affected Products (16)

codesys · control_for_beaglebone (up to 3.5.14.10)vulnerable

codesys · control_for_empc-a\/imx6 (up to 3.5.14.10)vulnerable

codesys · control_for_iot2000 (up to 3.5.14.10)vulnerable

codesys · control_for_linux (up to 3.5.14.10)vulnerable

codesys · control_for_pfc100 (up to 3.5.14.10)vulnerable

codesys · control_for_pfc200 (up to 3.5.14.10)vulnerable

codesys · control_for_raspberry_pi (up to 3.5.14.10)vulnerable

codesys · control_rte (up to 3.5.12.80)vulnerable

codesys · control_rte (up to 3.5.14.10)vulnerable

codesys · control_runtime_system_toolkit (up to 3.5.12.80)vulnerable

codesys · control_winvulnerable

codesys · control_win (up to 3.5.14.10)vulnerable

codesys · embedded_target_visu_toolkit (up to 3.5.12.80)vulnerable

codesys · hmi (up to 3.5.12.80)vulnerable

codesys · hmi (up to 3.5.14.10)vulnerable

codesys · remote_target_visu_toolkit (up to 3.5.12.80)vulnerable

References (2)

https://www.us-cert.gov/ics/advisories/icsa-19-255-01

MitigationPatchThird Party Advisory

https://www.us-cert.gov/ics/advisories/icsa-19-255-01

MitigationPatchThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs