CVE-2018-20026

moderate-risk

Published 2019-02-19

Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0.

Do I need to act?

0.92% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Control For Beaglebone Sl

Control For Empc-A\/Imx6 Sl

Control For Iot2000 Sl

Control For Linux Sl

Control For Pfc100 Sl

Control For Pfc200 Sl

Control For Raspberry Pi Sl

Control Rte Sl

Control Rte Sl \(For Beckhoff Cx\)

Control Runtime Toolkit

Control Win Sl

Development System V3

Gateway

Hmi Sl

Opc Server

Plchandler

Safety Sil2

Targetvisu Sl

Codesys

Broken Link http://www.securityfocus.com/bid/106251

Mitigation https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18...

Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-18-352-04

Broken Link http://www.securityfocus.com/bid/106251

Mitigation https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18...

Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-18-352-04

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 3/34 · Minimal

Exposure 19/34 · Moderate