High severity · published Sep 13, 2019
CVE-2019-13532
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted…
7.5
CVSS
3.2%
EPSS
No
On KEV
Description
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Control For Beaglebone · Codesys
before 3.5.14.10 · source: NVD
CF
Control For Empc-a/imx6 · Codesys
before 3.5.14.10 · source: NVD
CF
Control For Iot2000 · Codesys
before 3.5.14.10 · source: NVD
CF
Control For Linux · Codesys
before 3.5.14.10 · source: NVD
CF
Control For Pfc100 · Codesys
before 3.5.14.10 · source: NVD
CF
Control For Pfc200 · Codesys
before 3.5.14.10 · source: NVD
CF
Control For Raspberry PI · Codesys
before 3.5.14.10 · source: NVD
CR
Control Rte · Codesys
3.5.8.60 before 3.5.12.80; 3.5.13.0 before 3.5.14.10 · source: NVD
CR
Control Runtime System Toolkit · Codesys
3.0 before 3.5.12.80 · source: NVD
CW
Control Win · Codesys
3.5.9.80 through 3.5.12.80; 3.5.13.0 before 3.5.14.10 · source: NVD
ET
Embedded Target Visu Toolkit · Codesys
3.0 before 3.5.12.80 · source: NVD
HM
Hmi · Codesys
3.5.10.0 before 3.5.12.80; 3.5.13.0 before 3.5.14.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13532
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13532
Mitigation
https://www.us-cert.gov/ics/advisories/icsa-19-255-01
More from Control For Beaglebone
9.8
CVE-2020-10245
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow
9.8
CVE-2019-18858
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow
9.8
CVE-2019-13548
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a…
8.8
CVE-2018-25048
The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS…
8.8
CVE-2019-9008
An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30