Summary
Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um einen Denial-of-Service-Zustand auszulösen, Daten zu manipulieren und vertrauliche Informationen preiszugeben.
Product
CODESYS ist eine herstellerunabhängige Automatisierungssoftware für die Entwicklung von Steuerungsanwendungen in der industriellen Automatisierung.
Vulnerabilities 3
-
High 8.3
CODESYS Control PKI Exposure Enables Remote Certificate Access
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain…
-
High 7.5
CODESYS Control DoS via Unauthenticated NULL Pointer Dereference
An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.
-
Medium 5.5
CODESYS Toolkit Exposes Sensitive Files via Default Permissions
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2025-23491, EUVD-2025-23492, EUVD-2025-23490
-
#1
Initiale Fassung
References
-
VDE CERT Advisory vom 2025-08-03
https://certvde.com/de/advisories/VDE-2025-049
-
VDE CERT Advisory vom 2025-08-03
https://certvde.com/de/advisories/VDE-2025-051
-
VDE CERT Advisory vom 2025-08-03
https://certvde.com/de/advisories/VDE-2025-070/