Description
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.
Advisories 9
- ICSA-26-076-01 CODESYS in Festo Automation Suite CISA ICS & IT advisories · Mar 17, 2026
- FSA-202601 Several CODESYS vulnerabilities in Festo Automation Suite CERT@VDE · Feb 26, 2026
- ICSA-25-273-04 Festo Controller CECC-S,-LK,-D Family Firmware (Update A) CISA ICS & IT advisories · Nov 13, 2025
- FSA-202202 Festo: Controller CECC-S,LK,D family <= 2.3.8.1 - multiple vulnerabilities in CODESYS V3 runtime system CERT@VDE · Nov 3, 2025
- FSA-202203 Festo: Controller CECC-S,LK,D family firmware 2.4.2.0 - multiple vulnerabilities in CODESYS V3 runtime system CERT@VDE · Jul 10, 2025
- VDE-2022-035 WAGO: Multiple product series affected by multiple CODESYS vulnerabilities CERT@VDE · Aug 17, 2022
- VDE-2021-061 Pilz: PMC programming tool 3.x.x affected by multiple vulnerabilities CERT@VDE · Apr 26, 2022
- VDE-2021-054 Pilz: Multiple vulnerabilities in CODESYS V2 and V3 runtime system CERT@VDE · Apr 26, 2022
- VDE-2021-033 TRUMPF Laser GmbH: multiple products prone to codesys runtime vulnerabilities CERT@VDE · Aug 12, 2021