Skip to content
Fencer Intel
critical 9.8

CVE-2019-9010 json

An issue was discovered in 3S-Smart CODESYS V3 products.

published 2019-08-15 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-18397

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.

Patch / fix

  • codesys control_for_beaglebone_sl 3.5.14.20
  • codesys control_for_empc-a/imx6_sl 3.5.14.20
  • codesys control_for_iot2000_sl 3.5.14.20
  • codesys control_for_linux_sl 3.5.14.20
  • codesys control_for_pfc100_sl 3.5.14.20
  • codesys control_for_pfc200_sl 3.5.14.20
  • codesys control_for_raspberry_pi_sl 3.5.14.20
  • codesys control_runtime_toolkit 3.5.14.20
  • codesys development_system 3.5.14.20
  • codesys gateway 3.5.14.20

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-076-01 updated cvss 9.8

CODESYS in Festo Automation Suite

  • CODESYS Development System 3.0 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138 CODESYS Development System 3.5.16.10 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138
    affected: mitigation
  • Festo Automation Suite 2.8.0.138 CODESYS Development System 3.5.21.20
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-273-04 updated cvss 9.8

Festo Controller CECC-S,-LK,-D Family Firmware (Update A)

  • Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-D (All versions) Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-S (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-LK (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-S (All versions)
    affected: mitigation “Festo has identified the following specific workarounds and mitigations users can apply to reduce risk:” certvde.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-19-213-03 updated cvss 9.0

3S-Smart Software Solutions GmbH CODESYS V3

  • 3S-Smart Software Solutions GmbH CODESYS Control for BeagleBone < 3.5.14.20 3S-Smart Software Solutions GmbH CODESYS Control for emPC-A/iMX6 < 3.5.14.20 3S-Smart Software Solutions GmbH CODESYS Control for IOT2000 < 3.5.14.20 3S-Smart Software Solutions GmbH CODESYS Control for Linux < 3.5.14.20 3S-Smart Software Solutions GmbH CODESYS Control for PFC100 < 3.5.14.20 3S-Smart Software Solutions GmbH CODESYS Control for PFC200 < 3.5.14.20
    +4 more products
    3S-Smart Software Solutions GmbH CODESYS Control for Raspberry Pi < 3.5.14.20 3S-Smart Software Solutions GmbH CODESYS Control V3 Runtime System Toolkit < 3.5.14.20 3S-Smart Software Solutions GmbH CODESYS Gateway V3 < 3.5.14.20 3S-Smart Software Solutions GmbH CODESYS V3 Development System < 3.5.14.20
    affected: mitigation “3S-Smart Software Solutions GmbH has released v3.5.14.20 and v3.5.15.0. Each of these releases solve the noted vulnerabilities issues.” codesys.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

2.10% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.