Description
Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | Runtime Toolkit | V2 – < V2.4.7.57 | V2.4.7.57 |
| CODESYS | PLCWinNT | V2 – < V2.4.7.57 | V2.4.7.57 |
Advisories 4
- ICSA-26-076-01 CODESYS in Festo Automation Suite CISA ICS & IT advisories · Mar 17, 2026
- FSA-202601 Several CODESYS vulnerabilities in Festo Automation Suite CERT@VDE · Feb 26, 2026
- VDE-2022-040 WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime CERT@VDE · Sep 22, 2023
- WID-SEC-2023-0825 ABB AC-500: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 2, 2023