Improper access control in CODESYS Control for BeagleBone and CODESYS Control RTE - CVE-2018-10612

Vulnerability identifier: #VU16612

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10612

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions the target system.

The vulnerability exists due to user access management and communication encryption is not enabled by default. A remote unauthenticated attacker can gain access to the device and sensitive information, including user credentials.

CODESYS Control for BeagleBone
CODESYS Control RTE

Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Opensuse

Update the affected products to the version 3.5.14.0.

• https://www.codesys.com/security/security-reports.html

• Multiple vulnerabilities in CODESYS Control Products
• OpenSUSE Linux update for python3
• Red Hat update for python