Description
If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attacker can gain elevated rights due to a TOCTOU vulnerability in the CODESYS installer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | CODESYS Installer | 0.0.0 – < 2.6.1.0 | 2.6.1.0 |
Advisories 2
- WID-SEC-2026-0640 CODESYS Installer: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Mar 10, 2026
- ADVISORY2026-01_VDE-2026-012 CODESYS Installer - Possible Privilege Escalation CERT@VDE · Mar 10, 2026