Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in CODESYS Control und Development System ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen oder einen Denial of Service zu verursachen.
Product
CODESYS ist eine herstellerunabhängige Automatisierungssoftware für die Entwicklung von Steuerungsanwendungen in der industriellen Automatisierung.
Vulnerabilities 3
-
High 7.8
CODESYS Development System - Deserialization of Untrusted Data
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.
-
High 7.5
CODESYS Control - Invalid type usage in visualization
An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.
-
Medium 5.9
CODESYS Control - Linux/QNX SysSocket flaw
An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a den…
Revision history
-
#3
Neue Updates aufgenommen
-
#2
Referenz(en) aufgenommen: EUVD-2025-199974, EUVD-2025-199975, EUVD-2025-199976
-
#1
Initiale Fassung
References
-
VDE Cert Advisory vom 2025-11-30
https://certvde.com/de/advisories/VDE-2025-099/
-
VDE Cert Advisory vom 2025-11-30
https://certvde.com/de/advisories/VDE-2025-100/
-
VDE Cert Advisory vom 2025-11-30
https://certvde.com/de/advisories/VDE-2025-101/
-
ABB Security Advisory vom 2026-09-28
https://search.abb.com/library/Download.aspx?DocumentID=3ADR011565&LanguageCode=en&DocumentPartId=&Action=Launch