Description
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | CODESYS V2 | Runtime Toolkit 32 bit full – < V2.4.7.56, PLCWinNT – < V2.4.7.56 | V2.4.7.56 |
Advisories 5
- ICSA-26-076-01 CODESYS in Festo Automation Suite CISA ICS & IT advisories · Mar 17, 2026
- FSA-202601 Several CODESYS vulnerabilities in Festo Automation Suite CERT@VDE · Feb 26, 2026
- VDE-2021-049 WAGO: Denial of Service Vulnerability in CODESYS Runtime 2.3 CERT@VDE · May 22, 2025
- VDE-2021-054 Pilz: Multiple vulnerabilities in CODESYS V2 and V3 runtime system CERT@VDE · Apr 26, 2022
- VDE-2021-055 Pilz: PMC programming tool 2.x.x affected by multiple vulnerabilities CERT@VDE · Apr 26, 2022
References
- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16877&token=8faab0fc1e069f4edfca5d5aba8146139f67a175&download=
- 20211029 SEC Consult SA-20211028-0 :: Denial of Service in CODESYS V2 mailing-list
- http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html
- http://packetstormsecurity.com/files/165874/WAGO-750-8xxx-PLC-Denial-Of-Service-User-Enumeration.html