Description
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | CODESYS Development System | V2 – < V2.3.9.69, V3 – < V3.5.18.30 | V2.3.9.69 |
| CODESYS | CODESYS Gateway Client | V2 – < V2.3.9.38 | V2.3.9.38 |
| CODESYS | CODESYS Gateway Server | V2 – < V2.3.9.38 | V2.3.9.38 |
| CODESYS | CODESYS Web server | V1 – < V1.1.9.23 | V1.1.9.23 |
| CODESYS | CODESYS SP Realtime NT | V2 – < V2.3.7.30 | V2.3.7.30 |
| CODESYS | CODESYS PLCWinNT | V2 – < V2.4.7.57 | V2.4.7.57 |
| CODESYS | CODESYS Runtime Toolkit 32 bit full | V2 – < V2.4.7.57 | V2.4.7.57 |
| CODESYS | CODESYS Edge Gateway for Windows | V3 – < V3.5.18.30 | V3.5.18.30 |
| CODESYS | CODESYS HMI (SL) | V3 – < V3.5.18.30 | V3.5.18.30 |
| CODESYS | CODESYS OPC DA Server SL | V3 – < V3.5.18.30 | V3.5.18.30 |
| CODESYS | CODESYS PLCHandler | V3 – < V3.5.18.30 | V3.5.18.30 |
| CODESYS | CODESYS Gateway | V3 – < V3.5.18.30 | V3.5.18.30 |
Advisories 4
- ICSA-26-076-01 CODESYS in Festo Automation Suite CISA ICS & IT advisories · Mar 17, 2026
- FSA-202601 Several CODESYS vulnerabilities in Festo Automation Suite CERT@VDE · Feb 26, 2026
- VDE-2022-040 WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime CERT@VDE · Sep 22, 2023
- WID-SEC-2023-0825 ABB AC-500: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 2, 2023