CVE-2018-10612: 3s-smart 3s-smart software solutions gmbh codesys control v3 products prior to version 3.5.14.0 Improper Access Control

Vulnerability summary

CVE-2018-10612 is a high (CVSS 10.0) Improper Access Control vulnerability in 3s-smart 3s-smart software solutions gmbh codesys control v3 products prior to version 3.5.14.0. EPSS estimates a 1.26% chance of exploitation in the next 30 days, higher than 69.1% of scored vulnerabilities.

Timeline

1. 29-01-2019
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-311Missing Encryption of Sensitive DataThe product does not encrypt sensitive or critical information before storage or transmission.
• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.