NVD Vulnerability Detail

CVE-2018-10612

Summary	In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.
Publication Date	Jan. 30, 2019, 1:29 a.m.
Registration Date	March 1, 2021, 6:43 p.m.
Last Update	Nov. 21, 2024, 12:41 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:codesys:control_for_beaglebone_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_iot2000_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_linux_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_pfc100_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_pfc200_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_raspberry_pi_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_rte_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_win_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_runtime_toolkit::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:hmi_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:development_system_v3::::::::	3.0			3.5.14.0

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/106248	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/106248	Third Party Advisory VDB Entry
3	https://ics-cert.us-cert.gov/advisories/ICSA-18-352-03	Third Party Advisory US Government Resource
4	https://ics-cert.us-cert.gov/advisories/ICSA-18-352-03	Third Party Advisory US Government Resource

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-311	重要なデータの暗号化の欠如	https://cwe.mitre.org/data/definitions/311.html
2	CWE-732	重要なリソースに対する不適切なパーミッションの割り当て	https://cwe.mitre.org/data/definitions/732.html

JVN Vulnerability Information

3S-Smart Software Solutions GmbH CODESYS Control V3 製品におけるアクセス制御に関する脆弱性

Title	3S-Smart Software Solutions GmbH CODESYS Control V3 製品におけるアクセス制御に関する脆弱性
Summary	3S-Smart Software Solutions GmbH CODESYS Control V3 製品には、アクセス制御に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Dec. 18, 2018, midnight
Registration Date	March 29, 2019, 12:15 p.m.
Last Update	March 29, 2019, 12:15 p.m.

Affected System

3S-Smart Software Solutions

CODESYS Control for BeagleBone 3.5.14.0 未満

CODESYS Control for emPC-A/iMX6 3.5.14.0 未満

CODESYS Control for IOT2000 3.5.14.0 未満

CODESYS Control for Linux 3.5.14.0 未満

CODESYS Control for PFC100 3.5.14.0 未満

CODESYS Control for PFC200 3.5.14.0 未満

CODESYS Control for Raspberry Pi 3.5.14.0 未満

CODESYS Control RTE V3 3.5.14.0 未満

CODESYS Control Runtime Toolkit 3.5.14.0 未満

CODESYS Control Win SL 3.5.14.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-10612	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10612
National Vulnerability Database (NVD)
2	CVE-2018-10612	https://nvd.nist.gov/vuln/detail/CVE-2018-10612

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-284	https://cwe.mitre.org/data/definitions/284.html

ベンダー情報

No	Name	URL
3S-Smart Software Solutions
1	Top Page	https://www.codesys.com/

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-18-352-03	https://ics-cert.us-cert.gov/advisories/ICSA-18-352-03
2	ICSA-25-273-04	https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-04
JVN
3	JVNVU#90492166	https://jvn.jp/vu/JVNVU90492166/index.html

Change Log

No	Changed Details	Date of change
1	[2019年03月29日] 掲載	March 29, 2019, 12:15 p.m.
2	[2025年10月02日] 参考情報：JVN (JVNVU#90492166) を追加参考情報：ICS-CERT ADVISORY (ICSA-25-273-04) を追加	Oct. 2, 2025, 1:50 p.m.