Description
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | CODESYS V2 | Runtime Toolkit 32 bit full – < V2.4.7.56, PLCWinNT – < V2.4.7.56 | V2.4.7.56 |
Advisories 6
- ICSA-26-076-01 CODESYS in Festo Automation Suite CISA ICS & IT advisories · Mar 17, 2026
- FSA-202601 Several CODESYS vulnerabilities in Festo Automation Suite CERT@VDE · Feb 26, 2026
- VDE-2021-056 WAGO: Multiple Vulnerabilities in CODESYS Runtime 2.3 and WebVisualisation CERT@VDE · May 22, 2025
- WID-SEC-2023-0825 ABB AC-500: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 2, 2023
- VDE-2021-054 Pilz: Multiple vulnerabilities in CODESYS V2 and V3 runtime system CERT@VDE · Apr 26, 2022
- VDE-2021-055 Pilz: PMC programming tool 2.x.x affected by multiple vulnerabilities CERT@VDE · Apr 26, 2022