CVE-2017-6027

CRITICAL 9.8CVE-2017-6027 · Published 19/05/2017 · updated 17/06/2026

In short

CVE-2017-6027 is a CRITICAL (CVSS 9.8) vulnerability affecting web server (codesys).
Chance of exploitation in the next 30 days (EPSS): 2.6%, higher than 85.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
web server codesys	`≤ 2.3`	No fix yet

Description

An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the CODESYS WebVisu web browser visualization software, are affected: CODESYS Web Server Versions 2.3 and prior. A specially crafted web server request may allow the upload of arbitrary files (with a dangerous type) to the CODESYS Web Server without authorization which may allow remote code execution.

References

securityfocus.com/bid/97174 · Third Party Advisory
ics-cert.us-cert.gov/advisories/ICSA-17-087-02 · Third Party Advisory

More vulnerabilities in web server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free