Description
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | CODESYS Development System | 3.5.11.20 – < 3.5.19.20 | 3.5.19.20 |
Advisories 7
- ICSA-26-076-01 CODESYS in Festo Automation Suite CISA ICS & IT advisories · Mar 17, 2026
- FSA-202601 Several CODESYS vulnerabilities in Festo Automation Suite CERT@VDE · Feb 26, 2026
- ICSA-26-020-02 Schneider Electric devices using CODESYS Runtime CISA ICS & IT advisories · Jan 20, 2026
- SEVD-2023-192-04 CODESYS Runtime Vulnerabilities Schneider Electric CPCERT · Dec 9, 2025
- WID-SEC-2024-0943 CODESYS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 7, 2025
- ICSA-23-236-05 CODESYS Development System CISA ICS & IT advisories · Aug 24, 2023
- VDE-2023-022 CODESYS: Missing integrity check in CODESYS Development System CERT@VDE · Aug 3, 2023