CVE record · CVE-2018-25048

Codesys Runtime Improper Limitation of a Pathname

CVSS 8.8 HighEPSS 0.010 · 63rd percentile

Published by the CVE Program (CNA: CERTVDE) at 23 Mar 2023, 10:45 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
CODESYS	Control for BeagleBone	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	Control for emPC-A/iMX6	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	Control for IOT2000	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	Control for PFC100	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	Control for PFC200	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	Control for Raspberry Pi	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	Control RTE V3 (all variants)	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	Control Win V3 (all variants)	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	V3 Simulation Runtime (part of the CODESYS Development System)	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	HMI V3 (all variants)	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	V3 Remote Target Visu (all variants)	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	Control V3 Runtime System Toolkit	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	V3 Embedded Target Visu Toolkit	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	V3 Remote Target Visu Toolkit	affected 3.0.0.0 to before 3.5.12.30 custom Other versions: unaffected
CODESYS	Runtime Toolkit 32 bit embedded	affected 2.0.0.0 to before 2.3.2.10 custom Other versions: unaffected
CODESYS	Runtime Toolkit 32 bit full	affected 2.0.0.0 to before 2.4.7.52 custom Other versions: unaffected
CODESYS	Runtime PLCWinNT	affected 2.0.0.0 to before 2.4.7.52 custom Other versions: unaffected

Identifiers: CVE-2018-25048
CNA: CERTVDE
Weakness (CWE): CWE-22
Tags: CODESYS Control for BeagleBone
CODESYS Control for emPC-A/iMX6
CODESYS Control for IOT2000
CODESYS Control for PFC100
CODESYS Control for PFC200
CODESYS Control for Raspberry Pi
CODESYS Control RTE V3 (all variants)
CODESYS Control Win V3 (all variants)
Path traversal
Published: 23 Mar 2023
Updated: 19 Feb 2025

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
8.8	High	3.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CNA (CERTVDE)

CISA KEV Not listed.
EPSS 0.010, the 63rd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 23 Mar 2023. New records show when each source confirmed them.

Sources

References from the CNA

customers.codesys.com/fileadmin/data/customers/security/2018/Advisory2018-04_CDS-59017.pdf

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.