Skip to content
Fencer Vulns
critical 9.8

CVE-2018-10612 json

In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encrypt…

published 2019-01-29 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-2684

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.

Patch / fix

  • codesys control_for_beaglebone_sl 3.5.14.0
  • codesys control_for_empc-a/imx6_sl 3.5.14.0
  • codesys control_for_iot2000_sl 3.5.14.0
  • codesys control_for_linux_sl 3.5.14.0
  • codesys control_for_pfc100_sl 3.5.14.0
  • codesys control_for_pfc200_sl 3.5.14.0
  • codesys control_for_raspberry_pi_sl 3.5.14.0
  • codesys control_rte_sl 3.5.14.0
  • codesys control_runtime_toolkit 3.5.14.0
  • codesys control_win_sl 3.5.14.0
  • codesys development_system_v3 3.5.14.0
  • codesys hmi_sl 3.5.14.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-076-01 updated cvss 9.8

CODESYS in Festo Automation Suite

  • CODESYS Development System 3.0 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138 CODESYS Development System 3.5.16.10 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138
    affected: mitigation
  • Festo Automation Suite 2.8.0.138 CODESYS Development System 3.5.21.20
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-273-04 updated cvss 9.8

Festo Controller CECC-S,-LK,-D Family Firmware (Update A)

  • Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-D (All versions) Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-S (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-LK (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-S (All versions)
    affected: mitigation “Festo has identified the following specific workarounds and mitigations users can apply to reduce risk:” certvde.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-18-352-03 updated cvss 9.8

3S-Smart Software Solutions GmbH CODESYS Control V3 Products

  • 3S-Smart Software Solutions GmbH CODESYS Control for BeagleBone < 3.5.14.0 3S-Smart Software Solutions GmbH CODESYS Control for emPC-A/iMX6 < 3.5.14.0 3S-Smart Software Solutions GmbH CODESYS Control for IOT2000 < 3.5.14.0 3S-Smart Software Solutions GmbH CODESYS Control for Linux < 3.5.14.0 3S-Smart Software Solutions GmbH CODESYS Control for PFC100 < 3.5.14.0 3S-Smart Software Solutions GmbH CODESYS Control for PFC200 < 3.5.14.0
    +8 more products
    3S-Smart Software Solutions GmbH CODESYS Control for Raspberry Pi < 3.5.14.0 3S-Smart Software Solutions GmbH CODESYS Control RTE V3 < 3.5.14.0 3S-Smart Software Solutions GmbH CODESYS Control RTE V3 (for Beckhoff CX) < 3.5.14.0 3S-Smart Software Solutions GmbH CODESYS Control V3 Runtime System Toolkit < 3.5.14.0 3S-Smart Software Solutions GmbH CODESYS Control Win V3 (also part of the CODESYS setup) < 3.5.14.0 3S-Smart Software Solutions GmbH CODESYS HMI V3 < 3.5.14.0 3S-Smart Software Solutions GmbH CODESYS V3 Simulation Runtime (part of the CODESYS Development System) < 3.5.14.0 3S-Smart Software Solutions GmbH Control for BeagleBone < 3.5.14.0
    affected: mitigation “Use controllers and devices only in a protected environment to minimize network exposure and ensure controllers are not accessible from outside” codesys.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.39% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • 3S-Smart 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0

Classification

Weakness
  • CWE-284 Improper Access Control
  • CWE-311 Missing Encryption of Sensitive Data
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.