NVD Vulnerability Detail

CVE-2018-20025

Summary	Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.
Publication Date	Feb. 20, 2019, 6:29 a.m.
Registration Date	March 1, 2021, 7:15 p.m.
Last Update	Nov. 21, 2024, 1 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:codesys:control_for_beaglebone_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_iot2000_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_linux_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_pfc100_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_pfc200_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_for_raspberry_pi_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_rte_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\)::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_win_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:control_runtime_toolkit::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:safety_sil2::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:hmi_sl::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:gateway::::::::	3.0			3.5.14.0
cpe:2.3:a:codesys:development_system::::::::	3.0			3.5.14.0

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/106251	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/106251	Third Party Advisory VDB Entry
3	https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-037-codesys-control-v3-use-of-insufficiently-random-values/	Mitigation Third Party Advisory
4	https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-037-codesys-control-v3-use-of-insufficiently-random-values/	Mitigation Third Party Advisory
5	https://ics-cert.us-cert.gov/advisories/ICSA-18-352-04
6	https://ics-cert.us-cert.gov/advisories/ICSA-18-352-04

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-330	不十分なランダム値の使用	https://cwe.mitre.org/data/definitions/330.html

JVN Vulnerability Information

CODESYS 製品における不十分なランダム値の使用に関する脆弱性

Title	CODESYS 製品における不十分なランダム値の使用に関する脆弱性
Summary	CODESYS 製品には、不十分なランダム値の使用に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Dec. 18, 2018, midnight
Registration Date	March 29, 2019, 9:44 a.m.
Last Update	March 29, 2019, 9:44 a.m.

Affected System

3S-Smart Software Solutions

CODESYS Control for BeagleBone

CODESYS Control for emPC-A/iMX6

CODESYS Control for IOT2000

CODESYS Control for Linux

CODESYS Control for PFC100

CODESYS Control for PFC200

CODESYS Control for Raspberry Pi

CODESYS Control RTE V3

CODESYS Control RTE V3 (for Beckhoff CX)

CODESYS Control Runtime Toolkit

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-20025	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20025
National Vulnerability Database (NVD)
2	CVE-2018-20025	https://nvd.nist.gov/vuln/detail/CVE-2018-20025

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-330	https://cwe.mitre.org/data/definitions/330.html

ベンダー情報

No	Name	URL
3S-Smart Software Solutions
1	Top Page	https://www.codesys.com/

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-18-352-04	https://ics-cert.us-cert.gov/advisories/ICSA-18-352-04
2	ICSA-25-273-04	https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-04
JVN
3	JVNVU#90492166	https://jvn.jp/vu/JVNVU90492166/index.html

Change Log

No	Changed Details	Date of change
1	[2019年03月29日] 掲載	March 29, 2019, 9:44 a.m.
2	[2025年10月02日] 参考情報：JVN (JVNVU#90492166) を追加参考情報：ICS-CERT ADVISORY (ICSA-25-273-04) を追加	Oct. 2, 2025, 4:31 p.m.