title: Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting
description: In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.
problem types: CWE-668 Exposure of Resource to Wrong Sphere
affected:
{
defaultStatus: unaffected
product: CODESYS Development System
vendor: CODESYS
versions:
lessThan: 3.5.17.0, status: affected, version: 3.5.9.0, versionType: semver
}
{
defaultStatus: unaffected
product: CODESYS Scripting
vendor: CODESYS
versions:
lessThan: 4.1.0.0, status: affected, version: 4.0.0.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL