CVE-2019-13532

Published: Sep 13, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.

Affected (16)

Products: Codesys: Control For Beaglebone, Control For Empc A/imx6, Control For Iot2000, Control For Linux, Control For Pfc100, Control For Pfc200, Control For Raspberry Pi, Control Rte, Control Runtime System Toolkit, Control Win, Embedded Target Visu Toolkit, Hmi, Remote Target Visu Toolkit

Codesys

13 products

Control For Beaglebone

Control For Empc A/imx6

Control For Raspberry Pi

Control Rte

Control Runtime System Toolkit

Control Win

Embedded Target Visu Toolkit

Hmi

Remote Target Visu Toolkit

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Codesys Control For Beaglebone	Before 3.5.14.10
Codesys Control For Empc A/imx6	Before 3.5.14.10
Codesys Control For Iot2000	Before 3.5.14.10
Codesys Control For Linux	Before 3.5.14.10
Codesys Control For Pfc100	Before 3.5.14.10
Codesys Control For Pfc200	Before 3.5.14.10
Codesys Control For Raspberry Pi	Before 3.5.14.10
Codesys Control Rte	From 3.5.13.0 to 3.5.14.10
Codesys Control Rte	From 3.5.8.60 to 3.5.12.80
Codesys Control Runtime System Toolkit	From 3.0 to 3.5.12.80
Codesys Control Win	From 3.5.13.0 to 3.5.14.10
Codesys Control Win	From 3.5.9.80 to 3.5.12.80
Codesys Embedded Target Visu Toolkit	From 3.0 to 3.5.12.80
Codesys Hmi	From 3.5.10.0 to 3.5.12.80
Codesys Hmi	From 3.5.13.0 to 3.5.14.10
Codesys Remote Target Visu Toolkit	From 3.0 to 3.5.12.80

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://www.us-cert.gov/ics/advisories/icsa-19-255-01

Source: ics-cert@hq.dhs.gov

MitigationPatchThird Party AdvisoryUS Government Resource

https://www.us-cert.gov/ics/advisories/icsa-19-255-01

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationPatchThird Party AdvisoryUS Government Resource

Timeline

No history available yet.