title: CODESYS Files or Directories Accessible to External Parties in CmpApp
description: In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
problem types: CWE-552 Files or Directories Accessible to External Parties
affected:
{
defaultStatus: unaffected
product: CODESYS Control for BeagleBone SL
vendor: CODESYS
versions:
lessThan: V4.10.0.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control for emPC-A/iMX6 SL
vendor: CODESYS
versions:
lessThan: V4.10.0.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control for IOT2000 SL
vendor: CODESYS
versions:
lessThan: V4.10.0.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control for Linux SL
vendor: CODESYS
versions:
lessThan: V4.10.0.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control for PFC100 SL
vendor: CODESYS
versions:
lessThan: V4.10.0.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control for PFC200 SL
vendor: CODESYS
versions:
lessThan: V4.10.0.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control for PLCnext SL
vendor: CODESYS
versions:
lessThan: V4.10.0.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control for Raspberry Pi SL
vendor: CODESYS
versions:
lessThan: V4.10.0.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control for WAGO Touch Panels 600 SL
vendor: CODESYS
versions:
lessThan: V4.10.0.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control RTE (for Beckhoff CX) SL
vendor: CODESYS
versions:
lessThan: V3.5.19.20, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control RTE (SL)
vendor: CODESYS
versions:
lessThan: V3.5.19.20, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control Runtime System Toolkit
vendor: CODESYS
versions:
lessThan: V3.5.19.20, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Control Win (SL)
vendor: CODESYS
versions:
lessThan: V3.5.19.20, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Development System V3
vendor: CODESYS
versions:
lessThan: V3.5.19.20, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS HMI (SL)
vendor: CODESYS
versions:
lessThan: V3.5.19.20, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Safety SIL2 Runtime Toolkit
vendor: CODESYS
versions:
lessThan: V3.5.19.20, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL