CVE-2020-10245

31

FAUCET Score

CVE-2020-10245 describes a critical buffer overflow vulnerability in the CODESYS V3 web server, affecting CODESYS Control runtime systems prior to version 3.5.15.40. This vulnerability carries a CVSS score of 9.8, indicating a critical severity, as it can be exploited remotely without authentication and has the potential for complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered some community discussion, suggesting awareness within the cybersecurity community.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 3.5.15.40CPE matchmatch criteria	cpe:2.3:a:codesys:control_for_beaglebone::::::::
		< 3.5.15.40CPE matchmatch criteria	cpe:2.3:a:codesys:control_for_empc-a\/imx6::::::::
		< 3.5.15.40CPE matchmatch criteria	cpe:2.3:a:codesys:control_for_iot2000::::::::
		< 3.5.15.40CPE matchmatch criteria	cpe:2.3:a:codesys:control_for_linux::::::::
		< 3.5.15.40CPE matchmatch criteria	cpe:2.3:a:codesys:control_for_pfc100::::::::

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

2.46%

Probability of exploitation in next 30 days

EPSS Percentile

82.8%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0246 is in the 73rd percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Patches (11)

amazonvendor investigatingvia llm_extracted

apollographqlvendor investigatingvia llm_extracted

boschvendor investigatingvia llm_extracted

dfinityvendor investigatingvia llm_extracted

fleetdmvendor investigatingvia llm_extracted

mathworksvendor investigatingvia llm_extracted

maxkbvendor investigatingvia llm_extracted

nxpvendor investigatingvia llm_extracted

openfirevendor investigatingvia llm_extracted

openstackvendor investigatingvia llm_extracted

opnsensevendor investigatingvia llm_extracted

Vendor Advisories (11)

fleetdmllm-fleetdm-dfa6928b76ca88dbCRITICAL

Multiple Vulnerabilities in 3S CODESYS Runtime in Rexroth PRC7000

amazonllm-amazon-e5068a99de6e4862CRITICAL

Multiple Vulnerabilities in 3S CODESYS Runtime in Rexroth PRC7000

apollographqlllm-apollographql-cd81770455aec26eCRITICAL

Multiple Vulnerabilities in 3S CODESYS Runtime in Rexroth PRC7000

dfinityllm-dfinity-0f95073f58c8726cCRITICAL

Multiple Vulnerabilities in 3S CODESYS Runtime in Rexroth PRC7000

mathworksllm-mathworks-ec6ff689b971de03CRITICAL

Multiple Vulnerabilities in 3S CODESYS Runtime in Rexroth PRC7000

maxkbllm-maxkb-92701f0debb498f4CRITICAL

CODESYS V3 Unauthenticated Remote Heap Overflow

openstackllm-openstack-a86d1efd31922814CRITICAL

CODESYS V3 Unauthenticated Remote Heap Overflow

nxpllm-nxp-f8f59f85b02a4cf8CRITICAL

CODESYS V3 Unauthenticated Remote Heap Overflow

openfirellm-openfire-3199177a0168b030CRITICAL

CODESYS V3 Unauthenticated Remote Heap Overflow

opnsensellm-opnsense-fc6f7542407c6d90CRITICAL

CODESYS V3 Unauthenticated Remote Heap Overflow

boschllm-bosch-f66d31f4a50624d6CRITICAL

CODESYS V3 Unauthenticated Remote Heap Overflow

References

customers.codesys.com / index.php

Vendor Advisory

tenable.com / security/research/tra-2020-16

ExploitThird Party Advisory