What the vulnerability does
01Description
The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.
CVE-2018-25048
HIGH
CVE-2018-25048: Codesys Runtime Improper Limitation of a Pathname
CVSS base score
8.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Key dates
02Disclosure timeline
March 23, 2023
CVE published
February 19, 2025
Record updated
External resources
03References
Related vulnerabilities
04Related CVE
CVE-2020-36728 Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal
CVE-2025-58321 DIALink - Directory Traversal Authentication Bypass Vulnerability
CVE-2025-34022 Selea Targa IP OCR-ANPR Camera Path Traversal
CVE-2025-11001 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
CVE-2025-5014 Home Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion
