Description
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | CODESYS | CODESYS GmbH CODESYS Development System 3.5.16, CODESYS GmbH CODESYS Development System 3.5.17 | — |
Advisories 4
- ICSA-26-076-01 CODESYS in Festo Automation Suite CISA ICS & IT advisories · Mar 17, 2026
- FSA-202601 Several CODESYS vulnerabilities in Festo Automation Suite CERT@VDE · Feb 26, 2026
- SEVD-2022-011-06 CODESYS V3 Runtime, Development System, and Gateway Vulnerabilities Schneider Electric CPCERT · Apr 11, 2023
- VDE-2021-061 Pilz: PMC programming tool 3.x.x affected by multiple vulnerabilities CERT@VDE · Apr 26, 2022