Vulnerability-Lookup

CVE-2025-0694 (GCVE-0-2025-0694)

Vulnerability from cvelistv5 – Published: 2025-03-18 11:04 – Updated: 2025-03-18 13:09

Title

CODESYS Control V3 removable media path traversal

Summary

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.

Severity

6.6 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-18 13:09 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

CERTVDE icscert root

References

1 reference

URL	Tags
https://cert.vde.com/en/advisories/VDE-2025-015

Impacted products

15 products

Vendor	Product	Version	CPE status
CODESYS	CODESYS Control for BeagleBone SL	Affected: 0 , < 4.16.0.0 (semver)	guessed
CODESYS	CODESYS Control for emPC-A/iMX6 SL	Affected: 0 , < 4.16.0.0 (semver)	guessed
CODESYS	CODESYS Control for IOT2000 SL	Affected: 0 , < 4.16.0.0 (semver)	guessed
CODESYS	CODESYS Control for Linux ARM SL	Affected: 0 , < 4.16.0.0 (semver)	guessed
CODESYS	CODESYS Control for Linux SL	Affected: 0 , < 4.16.0.0 (semver)	guessed
CODESYS	CODESYS Control for PFC100 SL	Affected: 0 , < 4.16.0.0 (semver)	guessed
CODESYS	CODESYS Control for PFC200 SL	Affected: 0 , < 4.16.0.0 (semver)	guessed
CODESYS	CODESYS Control for PLCnext SL	Affected: 0 , < 4.16.0.0 (semver)	guessed
CODESYS	CODESYS Control for Raspberry Pi SL	Affected: 0 , < 4.16.0.0 (semver)	guessed
CODESYS	CODESYS Control for WAGO Touch Panels 600 SL	Affected: 0 , < 4.16.0.0 (semver)	guessed
CODESYS	CODESYS Control RTE (for Beckhoff CX) SL	Affected: 0 , < 3.5.21.0 (semver)	guessed
CODESYS	CODESYS Control RTE (SL)	Affected: 0 , < 3.5.21.0 (semver)	guessed
CODESYS	CODESYS Control Win (SL)	Affected: 0 , < 3.5.21.0 (semver)	guessed
CODESYS	CODESYS Runtime Toolkit	Affected: 0 , < 3.5.21.0 (semver)	guessed
CODESYS	CODESYS Virtual Control SL	Affected: 0 , < 4.16.0.0 (semver)	guessed

Credits

D. Blagojevic, S.Dietz and T. Weber from CyberDanube

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0694",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-18T13:09:24.499918Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-18T13:09:54.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for BeagleBone SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for emPC-A/iMX6 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for IOT2000 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for Linux ARM SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for Linux SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for PFC100 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for PFC200 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for PLCnext SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for Raspberry Pi SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for WAGO Touch Panels 600 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control RTE (for Beckhoff CX) SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control RTE (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control Win (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Runtime Toolkit",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Virtual Control SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "D. Blagojevic, S.Dietz and T. Weber from CyberDanube"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access."
            }
          ],
          "value": "Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-18T11:04:06.167Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2025-015"
        }
      ],
      "source": {
        "advisory": "VDE-2025-015",
        "defect": [
          "CERT@VDE#641743"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "CODESYS Control V3 removable media path traversal",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2025-0694",
    "datePublished": "2025-03-18T11:04:06.167Z",
    "dateReserved": "2025-01-24T08:27:09.159Z",
    "dateUpdated": "2025-03-18T13:09:54.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-0694",
      "date": "2026-09-16",
      "epss": "0.00275",
      "percentile": "0.19977"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-0694\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2025-03-18T11:15:39.400\",\"lastModified\":\"2026-06-17T08:26:59.140\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.\"},{\"lang\":\"es\",\"value\":\"La validaci\u00f3n de ruta insuficiente en CODESYS Control permite que atacantes con pocos privilegios y acceso f\u00edsico obtengan acceso completo al sistema de archivos.\"}],\"affected\":[{\"source\":\"info@cert.vde.com\",\"affectedData\":[{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for BeagleBone SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.16.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for emPC-A/iMX6 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.16.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for IOT2000 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.16.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for Linux ARM SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.16.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for Linux SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.16.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for PFC100 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.16.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for PFC200 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.16.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for PLCnext SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.16.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for Raspberry Pi SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.16.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for WAGO Touch Panels 600 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.16.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control RTE (for Beckhoff CX) SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"3.5.21.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control RTE (SL)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"3.5.21.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control Win (SL)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"3.5.21.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Runtime Toolkit\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"3.5.21.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Virtual Control SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.16.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.7,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-03-18T13:09:24.499918Z\",\"id\":\"CVE-2025-0694\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://cert.vde.com/en/advisories/VDE-2025-015\",\"source\":\"info@cert.vde.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T16:57:23+00:00",
      "cve": "CVE-2025-0694",
      "id": "CVE-2025-0694",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CODESYS Control V3 removable media path traversal",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-0694.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-0694\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-18T13:09:24.499918Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-18T13:09:46.422Z\"}}], \"cna\": {\"title\": \"CODESYS Control V3 removable media path traversal\", \"source\": {\"defect\": [\"CERT@VDE#641743\"], \"advisory\": \"VDE-2025-015\", \"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"D. Blagojevic, S.Dietz and T. Weber from CyberDanube\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.6, \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for BeagleBone SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.16.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for emPC-A/iMX6 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.16.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for IOT2000 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.16.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for Linux ARM SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.16.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for Linux SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.16.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for PFC100 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.16.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for PFC200 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.16.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for PLCnext SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.16.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for Raspberry Pi SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.16.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for WAGO Touch Panels 600 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.16.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control RTE (for Beckhoff CX) SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.5.21.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control RTE (SL)\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.5.21.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control Win (SL)\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.5.21.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Runtime Toolkit\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.5.21.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Virtual Control SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.16.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://cert.vde.com/en/advisories/VDE-2025-015\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"shortName\": \"CERTVDE\", \"dateUpdated\": \"2025-03-18T11:04:06.167Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-0694\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-18T13:09:54.473Z\", \"dateReserved\": \"2025-01-24T08:27:09.159Z\", \"assignerOrgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"datePublished\": \"2025-03-18T11:04:06.167Z\", \"assignerShortName\": \"CERTVDE\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

ADVISORY2025-03_VDE-2025-015

Vulnerability from csaf_codesysgmbh - Published: 2025-03-18 11:00 - Updated: 2025-06-05 13:31

Summary

CODESYS Control V3 removable media path traversal

Scope

1 vulnerability in this advisory, including CVE-2025-0694.

CVE-2025-0694

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.

6.6 (Medium)


                
                  CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 15 products Known affected: 15 products

Open the full advisory

FKIE_CVE-2025-0694

Vulnerability from fkie_nvd - Published: 2025-03-18 11:15 - Updated: 2026-06-17 08:26

Severity

6.6 (Medium) - CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.

References

	URL	Tags
	info@cert.vde.com	https://cert.vde.com/en/advisories/VDE-2025-015

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for BeagleBone SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for emPC-A/iMX6 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for IOT2000 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for Linux ARM SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for Linux SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for PFC100 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for PFC200 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for PLCnext SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for Raspberry Pi SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for WAGO Touch Panels 600 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control RTE (for Beckhoff CX) SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control RTE (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control Win (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Runtime Toolkit",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Virtual Control SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.16.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "info@cert.vde.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access."
    },
    {
      "lang": "es",
      "value": "La validaci\u00f3n de ruta insuficiente en CODESYS Control permite que atacantes con pocos privilegios y acceso f\u00edsico obtengan acceso completo al sistema de archivos."
    }
  ],
  "id": "CVE-2025-0694",
  "lastModified": "2026-06-17T08:26:59.140",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 5.9,
        "source": "info@cert.vde.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-0694",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-03-18T13:09:24.499918Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-03-18T11:15:39.400",
  "references": [
    {
      "source": "info@cert.vde.com",
      "url": "https://cert.vde.com/en/advisories/VDE-2025-015"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "info@cert.vde.com",
      "type": "Secondary"
    }
  ]
}

FSA-202601

Vulnerability from csaf_festosecokg - Published: 2026-02-26 08:00 - Updated: 2026-02-26 08:00

Summary

Several CODESYS vulnerabilities in Festo Automation Suite

Severity

Critical

Scope

126 vulnerabilities in this advisory, including CVE-2025-0694.

CVE-2025-0694

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.

6.6 (Medium)


                
                  CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 1 product Known affected: 4 products

Open the full advisory

GHSA-G55G-4C57-8CCX

Vulnerability from github – Published: 2025-03-18 12:30 – Updated: 2025-03-18 12:30

Details

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.

Severity

6.6 (Medium)


                  
                    CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-0694"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-18T11:15:39Z",
    "severity": "MODERATE"
  },
  "details": "Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.",
  "id": "GHSA-g55g-4c57-8ccx",
  "modified": "2025-03-18T12:30:48Z",
  "published": "2025-03-18T12:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0694"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en/advisories/VDE-2025-015"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

ICSA-26-076-01

Vulnerability from csaf_cisa - Published: 2026-02-26 08:00 - Updated: 2026-03-17 06:00

Summary

CODESYS in Festo Automation Suite

Severity

Critical

Scope

126 vulnerabilities in this advisory, including CVE-2025-0694.

CVE-2025-0694

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.

6.6 (Medium)


                
                  CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 1 product Known affected: 4 products

Open the full advisory

VDE-2025-062

Vulnerability from csaf_wagogmbhcokg - Published: 2025-11-03 11:00 - Updated: 2025-11-03 11:00

Summary

WAGO: Multiple Vulnerabilities in CODESYS components

Severity

High

Scope

3 vulnerabilities in this advisory, including CVE-2025-0694.

CVE-2025-0694

Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.

6.6 (Medium)


                
                  CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 23 products Known affected: 23 products

Open the full advisory

WID-SEC-W-2025-0582

Vulnerability from csaf_certbund - Published: 2025-03-17 23:00 - Updated: 2025-03-17 23:00

Summary

CODESYS Control: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2025-0694.

CVE-2025-0694

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-0694 (GCVE-0-2025-0694)

ADVISORY2025-03_VDE-2025-015

FKIE_CVE-2025-0694

FSA-202601

GHSA-G55G-4C57-8CCX

ICSA-26-076-01

VDE-2025-062

WID-SEC-W-2025-0582

Tags

Sightings

Nomenclature

Related by attack behaviour