Description
A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | CODESYS Development System | 3.0.0.0 – < 3.5.19.20 | 3.5.19.20 |
Advisories 7
- ICSA-26-076-01 CODESYS in Festo Automation Suite CISA ICS & IT advisories · Mar 17, 2026
- FSA-202601 Several CODESYS vulnerabilities in Festo Automation Suite CERT@VDE · Feb 26, 2026
- ICSA-26-020-02 Schneider Electric devices using CODESYS Runtime CISA ICS & IT advisories · Jan 20, 2026
- SEVD-2023-192-04 CODESYS Runtime Vulnerabilities Schneider Electric CPCERT · Dec 9, 2025
- WID-SEC-2024-0943 CODESYS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 7, 2025
- ICSA-23-236-04 CODESYS Development System CISA ICS & IT advisories · Aug 24, 2023
- VDE-2023-023 CODESYS: Missing Brute-Force protection in CODESYS Development System CERT@VDE · Aug 3, 2023