Description
An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-default Basic128Rsa15 security policy.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | CODESYS Runtime Toolkit | < 3.5.21.0 | 3.5.21.0 |
Advisories 5
- ICSA-26-076-01 CODESYS in Festo Automation Suite CISA ICS & IT advisories · Mar 17, 2026
- FSA-202601 Several CODESYS vulnerabilities in Festo Automation Suite CERT@VDE · Feb 26, 2026
- VDE-2025-062 WAGO: Multiple Vulnerabilities in CODESYS components CERT@VDE · Nov 3, 2025
- ADVISORY2025-04_VDE-2025-022 CODESYS Control V3 - OPC UA Server Authentication bypass CERT@VDE · Jun 5, 2025
- WID-SEC-2025-0581 CODESYS Runtime Toolkit: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Mar 17, 2025