CVE-2018-10612

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 1.39%
EPSS Percentile: 72.34%
CISA KEV: Not listed

Description

In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.

Technical Details

CVSS Version: 3.0
CNA / NVD Source: [email protected]
Published: 29-Jan-2019 23:29
Last Modified: 17-Jun-2026 08:34
EPSS Date: 2026-11-06
CWE: CWE-284, CWE-311, CWE-732

CVSS Vector


            CVSS:3.0                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

3S-Smart · 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0 Source: CNA · [email protected]
Default status: unknown

3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0 — affected

Affected Products / Versions

codesys / control_for_beaglebone_sl Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*
codesys / control_for_empc-a\/imx6_sl Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:*
codesys / control_for_iot2000_sl Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*
codesys / control_for_linux_sl Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*
codesys / control_for_pfc100_sl Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*
codesys / control_for_pfc200_sl Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*
codesys / control_for_raspberry_pi_sl Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*
codesys / control_rte_sl Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*
codesys / control_runtime_toolkit Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:control_runtime_toolkit:*:*:*:*:*:*:*:*
codesys / control_win_sl Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*
codesys / development_system_v3 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:development_system_v3:*:*:*:*:*:*:*:*
codesys / hmi_sl Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.5.14.0
cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*

References

Last enrichment sync: 07-Nov-2026 09:52
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2018-10612 — Festo/CODESYS (Critical) Cyble Weekly Report Highlights Vulnerabilities Across AI, VMware and ICS

CVE (7)

MITRE ATT&CK (5)

Vendors (8)

Products (10)

Industries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.