CVE-2025-0694

CODESYS Control V3 removable media path traversal

State: Published
Severity: 6.6 Medium
Published: Mar 18, 2025
Updated: Mar 18, 2025
Reserved: Jan 24, 2025

Description

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
CODESYS Control for BeagleBone SLCODESYS	before 4.16.0.0Affected
CODESYS Control for emPC-A/iMX6 SLCODESYS	before 4.16.0.0Affected
CODESYS Control for IOT2000 SLCODESYS	before 4.16.0.0Affected
CODESYS Control for Linux ARM SLCODESYS	before 4.16.0.0Affected
CODESYS Control for Linux SLCODESYS	before 4.16.0.0Affected
CODESYS Control for PFC100 SLCODESYS	before 4.16.0.0Affected
CODESYS Control for PFC200 SLCODESYS	before 4.16.0.0Affected
CODESYS Control for PLCnext SLCODESYS	before 4.16.0.0Affected
CODESYS Control for Raspberry Pi SLCODESYS	before 4.16.0.0Affected
CODESYS Control for WAGO Touch Panels 600 SLCODESYS	before 4.16.0.0Affected
CODESYS Control RTE (for Beckhoff CX) SLCODESYS	before 3.5.21.0Affected
CODESYS Control RTE (SL)CODESYS	before 3.5.21.0Affected
CODESYS Control Win (SL)CODESYS	before 3.5.21.0Affected
CODESYS Runtime ToolkitCODESYS	before 3.5.21.0Affected
CODESYS Virtual Control SLCODESYS	before 4.16.0.0Affected

References

https://cert.vde.com/en/advisories/VDE-2025-015

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.