CVE-2012-6069

The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This could allow the attacker to affect the availability, integrity, and confidentiality of the device.

• CWE-23
• CWE-22

• http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.htmlVendor Advisory
• http://www.digitalbond.com/tools/basecamp/3s-codesys/
• https://us.codesys.com/ecosystem/security/
• https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01
• https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01
• http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01US Government Resource
• http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.htmlVendor Advisory
• http://www.digitalbond.com/tools/basecamp/3s-codesys/
• http://www.securityfocus.com/bid/56300
• http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdfUS Government Resource

Published

Jan 21, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-6063Double free vulnerability in the sftp_mkdir function in sftp…
• CVE-2012-6064Directory traversal vulnerability in lib/filemanager/imagema…
• CVE-2012-6065The OM Maximenu module 6.x-1.43 and earlier for Drupal, when…
• CVE-2012-6066freeSSHd.exe in freeSSHd through 1.2.6 allows remote attacke…
• CVE-2012-6067freeFTPd.exe in freeFTPd through 1.0.11 allows remote attack…
• CVE-2012-6068The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.…9.8
• CVE-2012-6070Falconpl before 0.9.6.9-git20120606 misuses the libcurl API …7.5
• CVE-2012-6071nuSOAP before 0.7.3-5 does not properly check the hostname o…7.5
• CVE-2012-6072CRLF injection vulnerability in Jenkins before 1.491, Jenkin…
• CVE-2012-6073Open redirect vulnerability in Jenkins before 1.491, Jenkins…
• CVE-2012-6074Cross-site scripting (XSS) vulnerability in Jenkins before 1…
• CVE-2012-6075Buffer overflow in the e1000_receive function in the e1000 d…