How severe is CVE-2020-12068?

CVE-2020-12068 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2020-12068 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-12068?

CVE-2020-12068 primarily affects Codesys Control For Beaglebone. In total, 12 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-12068?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-12068 published?

CVE-2020-12068 was published on 2020-05-14 and last updated on 2026-06-17.

CVE-2020-12068

CVE-2020-12068 is a medium-severity vulnerability in Codesys Control For Beaglebone with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 6.4
EPSS exploit prediction: 1% (56th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Codesys Control For Beaglebone
Published: 2020-05-14
Last modified: 2026-06-17

Description

An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation.

Frequently asked questions

What is CVE-2020-12068?: An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation.
How severe is CVE-2020-12068?: CVE-2020-12068 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2020-12068 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-12068?: CVE-2020-12068 primarily affects Codesys Control For Beaglebone. In total, 12 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-12068?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-12068 published?: CVE-2020-12068 was published on 2020-05-14 and last updated on 2026-06-17.

References

Affected products (12)

cpe:2.3:a:codesys:control_for_beaglebone:*:*:*:*:*:*:*:*
cpe:2.3:a:codesys:control_for_empc-a\/imx6:*:*:*:*:*:*:*:*
cpe:2.3:a:codesys:control_for_iot2000:*:*:*:*:*:*:*:*
cpe:2.3:a:codesys:control_for_pfc100:*:*:*:*:*:*:*:*
cpe:2.3:a:codesys:control_for_pfc200:*:*:*:*:*:*:*:*
cpe:2.3:a:codesys:control_for_plcnext:*:*:*:*:*:*:*:*
cpe:2.3:a:codesys:control_for_raspberry_pi:*:*:*:*:*:*:*:*
cpe:2.3:a:codesys:control_rte:*:*:*:*:*:*:*:*
cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:*
cpe:2.3:a:codesys:control_win:*:*:*:*:*:*:*:*
cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*
cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:*

More vulnerabilities in Codesys Control For Beaglebone

CVE-2020-10245 — Critical (CVSS 9.8): CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
CVE-2019-18858 — Critical (CVSS 9.8): CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.
CVE-2019-13548 — Critical (CVSS 9.8): CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https…
CVE-2018-25048 — High (CVSS 8.8): The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal…
CVE-2019-9008 — High (CVSS 8.8): An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over…
CVE-2020-12069 — High (CVSS 7.8): In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system…

All CVEs affecting Codesys Control For Beaglebone →