Description
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | CODESYS Development System | 3.5.9.0 – < 3.5.17.0 | 3.5.17.0 |
| CODESYS | CODESYS Scripting | 4.0.0.0 – < 4.1.0.0 | 4.1.0.0 |
Advisories 7
- ICSA-26-076-01 CODESYS in Festo Automation Suite CISA ICS & IT advisories · Mar 17, 2026
- FSA-202601 Several CODESYS vulnerabilities in Festo Automation Suite CERT@VDE · Feb 26, 2026
- ICSA-26-020-02 Schneider Electric devices using CODESYS Runtime CISA ICS & IT advisories · Jan 20, 2026
- SEVD-2023-192-04 CODESYS Runtime Vulnerabilities Schneider Electric CPCERT · Dec 9, 2025
- WID-SEC-2024-0943 CODESYS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 7, 2025
- VDE-2023-068 WAGO: Multiple Vulnerabilities in e!Cockpit and e!Runtime / CODESYS Runtime CERT@VDE · May 21, 2024
- VDE-2023-024 CODESYS: Vulnerability in CODESYS Development System and CODESYS Scripting CERT@VDE · Jul 28, 2023