Vulnerability · Published Mar 18, 2025 · Assigned by CERTVDE
CVE-2025-0694CODESYS Control V3 removable media path traversal
Medium 6.6
In plain English
A medium-severity path traversal in CODESYS Control for BeagleBone SL from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.3%top 79.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CODESYS | CODESYS Control for BeagleBone SL | 0 – before 4.16.0.0 |
| CODESYS | CODESYS Control for emPC-A/iMX6 SL | 0 – before 4.16.0.0 |
| CODESYS | CODESYS Control for IOT2000 SL | 0 – before 4.16.0.0 |
| CODESYS | CODESYS Control for Linux ARM SL | 0 – before 4.16.0.0 |
| CODESYS | CODESYS Control for Linux SL | 0 – before 4.16.0.0 |
| CODESYS | CODESYS Control for PFC100 SL | 0 – before 4.16.0.0 |
| CODESYS | CODESYS Control for PFC200 SL | 0 – before 4.16.0.0 |
| CODESYS | CODESYS Control for PLCnext SL | 0 – before 4.16.0.0 |
| CODESYS | CODESYS Control for Raspberry Pi SL | 0 – before 4.16.0.0 |
| CODESYS | CODESYS Control for WAGO Touch Panels 600 SL | 0 – before 4.16.0.0 |
| CODESYS | CODESYS Control RTE (for Beckhoff CX) SL | 0 – before 3.5.21.0 |
| CODESYS | CODESYS Control RTE (SL) | 0 – before 3.5.21.0 |
| CODESYS | CODESYS Control Win (SL) | 0 – before 3.5.21.0 |
| CODESYS | CODESYS Runtime Toolkit | 0 – before 3.5.21.0 |
| CODESYS | CODESYS Virtual Control SL | 0 – before 4.16.0.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H