ADVISORY2025-08_VDE-2025-070
Vulnerability from csaf_codesysgmbh - Published: 2025-08-04 08:00 - Updated: 2025-10-14 08:00Summary
CODESYS Control V3 - NULL pointer dereference
Severity
High
Notes
Summary: A vulnerability in the CODESYS Control runtime system's CmpDevice component allows unauthenticated attackers to cause a denial-of-service (DoS) via specially crafted communication requests.
The issue is triggered by a NULL pointer dereference and also affects systems when outdated CODESYS clients attempt to log in.
Only PLCs based on the CODESYS Runtime Toolkit containing the components CmpDevice, CmpAuditLog, and CmpSessionInformation are impacted.
**Update 1.1.0, 01.09.2025:** Updated remediation category - fixed SL runtimes are now available.
Impact: Exploitation of this vulnerability can lead to a denial-of-service (DoS) condition on affected PLCs, disrupting industrial control systems.
Mitigation: The vulnerability can be mitigated by restricting the allowed login authentication type "CmpUserMgr/UserLogin_AuthenticationType" to "ONLY_ASYMMETRIC". This can be configured either via the Device Security Settings dialog in the CODESYS Development System or directly in the configuration file of the CODESYS Control runtime system (CODESYSControl.cfg) by adding the following setting:
[CmpUserMgr]
SECURITY.UserLogin_AuthenticationType=ONLY_ASYMMETRIC
With this configuration in place, both potential attackers and legacy CODESYS protocol clients (prior to version 3.5.16.0) will be blocked from logging in, thereby preventing execution of the vulnerable code path.
Remediation: Update the following products to version 3.5.21.20.
* CODESYS Control RTE (SL)
* CODESYS Control RTE (for Beckhoff CX) SL
* CODESYS Control Win (SL)
* CODESYS HMI (SL)
* CODESYS Runtime Toolkit
Update the following products to version 4.17.0.0.
* CODESYS Control for BeagleBone SL
* CODESYS Control for emPC-A/iMX6 SL
* CODESYS Control for IOT2000 SL
* CODESYS Control for Linux ARM SL
* CODESYS Control for Linux SL
* CODESYS Control for PFC100 SL
* CODESYS Control for PFC200 SL
* CODESYS Control for PLCnext SL
* CODESYS Control for Raspberry Pi SL
* CODESYS Control for WAGO Touch Panels 600 SL
* CODESYS Virtual Control SL
The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
General Recommendation: As part of a security strategy, CODESYS GmbH strongly recommends at least the following best-practice
defense measures:
* Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside
* Use firewalls to protect and separate the control system network from other networks
* Activate and apply user management and password features
* Limit the access to both development and control system by physical means, operating system features, etc.
* Use encrypted communication links
* Use VPN (Virtual Private Networks) tunnels if remote access is required
* Protect both development and control system by using up to date virus detecting solutions
For more information and general recommendations for protecting machines and plants, see also the
CODESYS Security Whitepaper [here.](https://customers.codesys.com/fileadmin/data/customers/security/CODESYS-Security-Whitepaper.pdf)
Disclaimer: CODESYS GmbH assumes no liability whatsoever for indirect, collateral, accidental or consequential losses
that occur by the distribution and/or use of this document or any losses in connection with the distribution and/or use of this document. All information published in this document is provided on good faith by CODESYS GmbH.
Insofar as permissible by law, however, none of this information shall establish any guarantee, commitment or
liability on the part of CODESYS GmbH.
Note: Not all CODESYS features are available in all territories. For more information on geographic restrictions,
please contact sales@codesys.com.
An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.
7.5 (High)
Mitigation
The vulnerability can be mitigated by restricting the allowed login authentication type "CmpUserMgr/UserLogin_AuthenticationType" to "ONLY_ASYMMETRIC". This can be configured either via the Device Security Settings dialog in the CODESYS Development System or directly in the configuration file of the CODESYS Control runtime system (CODESYSControl.cfg) by adding the following setting:
[CmpUserMgr]
SECURITY.UserLogin_AuthenticationType=ONLY_ASYMMETRIC
With this configuration in place, both potential attackers and legacy CODESYS protocol clients (prior to version 3.5.16.0) will be blocked from logging in, thereby preventing execution of the vulnerable code path.
Vendor Fix
Update the following products to version 3.5.21.20.
* CODESYS Control RTE (SL)
* CODESYS Control RTE (for Beckhoff CX) SL
* CODESYS Control Win (SL)
* CODESYS HMI (SL)
* CODESYS Runtime Toolkit
The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
Vendor Fix
Update the following products to version 4.17.0.0.
* CODESYS Control for BeagleBone SL
* CODESYS Control for emPC-A/iMX6 SL
* CODESYS Control for IOT2000 SL
* CODESYS Control for Linux ARM SL
* CODESYS Control for Linux SL
* CODESYS Control for PFC100 SL
* CODESYS Control for PFC200 SL
* CODESYS Control for PLCnext SL
* CODESYS Control for Raspberry Pi SL
* CODESYS Control for WAGO Touch Panels 600 SL
* CODESYS Virtual Control SL
The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
References
Acknowledgments
CERT@VDE
certvde.com
{
"document": {
"acknowledgments": [
{
"organization": "CERT@VDE",
"summary": "coordination",
"urls": [
"https://certvde.com"
]
}
],
"aggregate_severity": {
"namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
"text": "High"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-GB",
"notes": [
{
"category": "summary",
"text": "A vulnerability in the CODESYS Control runtime system\u0027s CmpDevice component allows unauthenticated attackers to cause a denial-of-service (DoS) via specially crafted communication requests.\nThe issue is triggered by a NULL pointer dereference and also affects systems when outdated CODESYS clients attempt to log in.\nOnly PLCs based on the CODESYS Runtime Toolkit containing the components CmpDevice, CmpAuditLog, and CmpSessionInformation are impacted.\n\n**Update 1.1.0, 01.09.2025:** Updated remediation category - fixed SL runtimes are now available.",
"title": "Summary"
},
{
"category": "description",
"text": "Exploitation of this vulnerability can lead to a denial-of-service (DoS) condition on affected PLCs, disrupting industrial control systems. ",
"title": "Impact"
},
{
"category": "description",
"text": "The vulnerability can be mitigated by restricting the allowed login authentication type \"CmpUserMgr/UserLogin_AuthenticationType\" to \"ONLY_ASYMMETRIC\". This can be configured either via the Device Security Settings dialog in the CODESYS Development System or directly in the configuration file of the CODESYS Control runtime system (CODESYSControl.cfg) by adding the following setting:\n\n[CmpUserMgr]\nSECURITY.UserLogin_AuthenticationType=ONLY_ASYMMETRIC\n\nWith this configuration in place, both potential attackers and legacy CODESYS protocol clients (prior to version 3.5.16.0) will be blocked from logging in, thereby preventing execution of the vulnerable code path. \n",
"title": "Mitigation"
},
{
"category": "description",
"text": "Update the following products to version 3.5.21.20.\n* CODESYS Control RTE (SL)\n* CODESYS Control RTE (for Beckhoff CX) SL\n* CODESYS Control Win (SL)\n* CODESYS HMI (SL)\n* CODESYS Runtime Toolkit\n\nUpdate the following products to version 4.17.0.0.\n* CODESYS Control for BeagleBone SL\n* CODESYS Control for emPC-A/iMX6 SL\n* CODESYS Control for IOT2000 SL\n* CODESYS Control for Linux ARM SL\n* CODESYS Control for Linux SL\n* CODESYS Control for PFC100 SL\n* CODESYS Control for PFC200 SL\n* CODESYS Control for PLCnext SL\n* CODESYS Control for Raspberry Pi SL\n* CODESYS Control for WAGO Touch Panels 600 SL\n* CODESYS Virtual Control SL\n\nThe CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/. ",
"title": "Remediation"
},
{
"category": "general",
"text": "As part of a security strategy, CODESYS GmbH strongly recommends at least the following best-practice\ndefense measures:\n\n* Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n* Use firewalls to protect and separate the control system network from other networks\n* Activate and apply user management and password features\n* Limit the access to both development and control system by physical means, operating system features, etc.\n* Use encrypted communication links\n* Use VPN (Virtual Private Networks) tunnels if remote access is required\n* Protect both development and control system by using up to date virus detecting solutions\n\nFor more information and general recommendations for protecting machines and plants, see also the\nCODESYS Security Whitepaper [here.](https://customers.codesys.com/fileadmin/data/customers/security/CODESYS-Security-Whitepaper.pdf)",
"title": "General Recommendation"
},
{
"category": "legal_disclaimer",
"text": "CODESYS GmbH assumes no liability whatsoever for indirect, collateral, accidental or consequential losses\nthat occur by the distribution and/or use of this document or any losses in connection with the distribution and/or use of this document. All information published in this document is provided on good faith by CODESYS GmbH.\nInsofar as permissible by law, however, none of this information shall establish any guarantee, commitment or\nliability on the part of CODESYS GmbH.\n\nNote: Not all CODESYS features are available in all territories. For more information on geographic restrictions,\nplease contact sales@codesys.com.",
"title": "Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@codesys.com",
"name": "CODESYS GmbH",
"namespace": "https://www.codesys.com"
},
"references": [
{
"category": "external",
"summary": "CERT@VDE Security Advisories for CODESYS GmbH",
"url": "https://certvde.com/en/advisories/vendor/codesys"
},
{
"category": "self",
"summary": "Advisory2025-08_VDE-2025-070: CODESYS Control V3 - NULL pointer dereference - HTML",
"url": "https://certvde.com/en/advisories/VDE-2025-070/"
},
{
"category": "self",
"summary": "Advisory2025-08_VDE-2025-070: CODESYS Control V3 - NULL pointer dereference - CSAF",
"url": "https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2025/advisory2025-08_vde-2025-070.json"
},
{
"category": "external",
"summary": "CODESYS Security Advisories",
"url": "https://www.codesys.com/security/security-reports.html"
},
{
"category": "self",
"summary": "Advisory2025-08_VDE-2025-070: CODESYS Control V3 - NULL pointer dereference - PDF",
"url": "https://codesys.com/fileadmin/user_upload/CODESYS_Group/Ecosystem/Up-to-Date/Security/Security-Advisories/Advisory2025-08_CDS-94690.pdf"
}
],
"title": "CODESYS Control V3 - NULL pointer dereference",
"tracking": {
"aliases": [
"VDE-2025-070",
"CODESYS Security Advisory 2025-08"
],
"current_release_date": "2025-10-14T08:00:00.000Z",
"generator": {
"date": "2025-10-13T13:59:59.503Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.37"
}
},
"id": "Advisory2025-08_VDE-2025-070",
"initial_release_date": "2025-08-04T08:00:00.000Z",
"revision_history": [
{
"date": "2025-08-04T10:00:00.000Z",
"number": "1.0.0",
"summary": "Initial revision."
},
{
"date": "2025-09-01T10:00:00.000Z",
"number": "1.1.0",
"summary": "Updated remediation category - fixed SL runtimes are now available."
},
{
"date": "2025-10-14T08:00:00.000Z",
"number": "1.2.0",
"summary": "List of affected and fixed products corrected regarding CODESYS HMI (SL) and CODESYS Runtime Toolkit"
}
],
"status": "final",
"version": "1.2.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "3.5.21.10\u003c3.5.21.20",
"product": {
"name": "CODESYS Control RTE (SL) 3.5.21.10 \u003c 3.5.21.20",
"product_id": "CSAFPID-51001"
}
},
{
"category": "product_version",
"name": "3.5.21.20",
"product": {
"name": "CODESYS Control RTE (SL) 3.5.21.20",
"product_id": "CSAFPID-52001"
}
}
],
"category": "product_name",
"name": "CODESYS Control RTE (SL)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "3.5.21.10\u003c3.5.21.20",
"product": {
"name": "CODESYS Control RTE (for Beckhoff CX) SL 3.5.21.10 \u003c 3.5.21.20",
"product_id": "CSAFPID-51002"
}
},
{
"category": "product_version",
"name": "3.5.21.20",
"product": {
"name": "CODESYS Control RTE (for Beckhoff CX) SL 3.5.21.20",
"product_id": "CSAFPID-52002"
}
}
],
"category": "product_name",
"name": "CODESYS Control RTE (for Beckhoff CX) SL"
},
{
"branches": [
{
"category": "product_version_range",
"name": "3.5.21.10\u003c3.5.21.20",
"product": {
"name": "CODESYS Control Win (SL) 3.5.21.10 \u003c 3.5.21.20",
"product_id": "CSAFPID-51003"
}
},
{
"category": "product_version",
"name": "3.5.21.20",
"product": {
"name": "CODESYS Control Win (SL) 3.5.21.20",
"product_id": "CSAFPID-52003"
}
}
],
"category": "product_name",
"name": "CODESYS Control Win (SL)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "3.5.21.10\u003c3.5.21.20",
"product": {
"name": "CODESYS HMI (SL) 3.5.21.10 \u003c 3.5.21.20",
"product_id": "CSAFPID-51004"
}
},
{
"category": "product_version",
"name": "3.5.21.20",
"product": {
"name": "CODESYS HMI (SL) 3.5.21.20",
"product_id": "CSAFPID-52004"
}
}
],
"category": "product_name",
"name": "CODESYS HMI (SL)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "3.5.21.10\u003c3.5.21.20",
"product": {
"name": "CODESYS Runtime Toolkit 3.5.21.10 \u003c 3.5.21.20",
"product_id": "CSAFPID-51005"
}
},
{
"category": "product_version",
"name": "3.5.21.20",
"product": {
"name": "CODESYS Runtime Toolkit 3.5.21.20",
"product_id": "CSAFPID-52005"
}
}
],
"category": "product_name",
"name": "CODESYS Runtime Toolkit"
},
{
"branches": [
{
"category": "product_version_range",
"name": "4.16.0.0\u003c4.17.0.0",
"product": {
"name": "CODESYS Control for BeagleBone SL 4.16.0.0 \u003c 4.17.0.0",
"product_id": "CSAFPID-51006"
}
},
{
"category": "product_version",
"name": "4.17.0.0",
"product": {
"name": "CODESYS Control for BeagleBone SL 4.17.0.0",
"product_id": "CSAFPID-52006"
}
}
],
"category": "product_name",
"name": "CODESYS Control for BeagleBone SL"
},
{
"branches": [
{
"category": "product_version_range",
"name": "4.16.0.0\u003c4.17.0.0",
"product": {
"name": "CODESYS Control for emPC-A/iMX6 SL 4.16.0.0 \u003c 4.17.0.0",
"product_id": "CSAFPID-51007"
}
},
{
"category": "product_version",
"name": "4.17.0.0",
"product": {
"name": "CODESYS Control for emPC-A/iMX6 SL 4.17.0.0",
"product_id": "CSAFPID-52007"
}
}
],
"category": "product_name",
"name": "CODESYS Control for emPC-A/iMX6 SL"
},
{
"branches": [
{
"category": "product_version_range",
"name": "4.16.0.0\u003c4.17.0.0",
"product": {
"name": "CODESYS Control for IOT2000 SL 4.16.0.0 \u003c 4.17.0.0",
"product_id": "CSAFPID-51008"
}
},
{
"category": "product_version",
"name": "4.17.0.0",
"product": {
"name": "CODESYS Control for IOT2000 SL 4.17.0.0",
"product_id": "CSAFPID-52008"
}
}
],
"category": "product_name",
"name": "CODESYS Control for IOT2000 SL"
},
{
"branches": [
{
"category": "product_version_range",
"name": "4.16.0.0\u003c4.17.0.0",
"product": {
"name": "CODESYS Control for Linux ARM SL 4.16.0.0 \u003c 4.17.0.0",
"product_id": "CSAFPID-51009"
}
},
{
"category": "product_version",
"name": "4.17.0.0",
"product": {
"name": "CODESYS Control for Linux ARM SL 4.17.0.0",
"product_id": "CSAFPID-52009"
}
}
],
"category": "product_name",
"name": "CODESYS Control for Linux ARM SL"
},
{
"branches": [
{
"category": "product_version_range",
"name": "4.16.0.0\u003c4.17.0.0",
"product": {
"name": "CODESYS Control for Linux SL 4.16.0.0 \u003c 4.17.0.0",
"product_id": "CSAFPID-51010"
}
},
{
"category": "product_version",
"name": "4.17.0.0",
"product": {
"name": "CODESYS Control for Linux SL 4.17.0.0",
"product_id": "CSAFPID-52010"
}
}
],
"category": "product_name",
"name": "CODESYS Control for Linux SL"
},
{
"branches": [
{
"category": "product_version_range",
"name": "4.16.0.0\u003c4.17.0.0",
"product": {
"name": "CODESYS Control for PFC100 SL 4.16.0.0 \u003c 4.17.0.0",
"product_id": "CSAFPID-51011"
}
},
{
"category": "product_version",
"name": "4.17.0.0",
"product": {
"name": "CODESYS Control for PFC100 SL 4.17.0.0",
"product_id": "CSAFPID-52011"
}
}
],
"category": "product_name",
"name": "CODESYS Control for PFC100 SL"
},
{
"branches": [
{
"category": "product_version_range",
"name": "4.16.0.0\u003c4.17.0.0",
"product": {
"name": "CODESYS Control for PFC200 SL 4.16.0.0 \u003c 4.17.0.0",
"product_id": "CSAFPID-51012"
}
},
{
"category": "product_version",
"name": "4.17.0.0",
"product": {
"name": "CODESYS Control for PFC200 SL 4.17.0.0",
"product_id": "CSAFPID-52012"
}
}
],
"category": "product_name",
"name": "CODESYS Control for PFC200 SL"
},
{
"branches": [
{
"category": "product_version_range",
"name": "4.16.0.0\u003c4.17.0.0",
"product": {
"name": "CODESYS Control for PLCnext SL 4.16.0.0 \u003c 4.17.0.0",
"product_id": "CSAFPID-51013"
}
},
{
"category": "product_version",
"name": "4.17.0.0",
"product": {
"name": "CODESYS Control for PLCnext SL 4.17.0.0",
"product_id": "CSAFPID-52013"
}
}
],
"category": "product_name",
"name": "CODESYS Control for PLCnext SL"
},
{
"branches": [
{
"category": "product_version_range",
"name": "4.16.0.0\u003c4.17.0.0",
"product": {
"name": "CODESYS Control for Raspberry Pi SL 4.16.0.0 \u003c 4.17.0.0",
"product_id": "CSAFPID-51014"
}
},
{
"category": "product_version",
"name": "4.17.0.0",
"product": {
"name": "CODESYS Control for Raspberry Pi SL 4.17.0.0",
"product_id": "CSAFPID-52014"
}
}
],
"category": "product_name",
"name": "CODESYS Control for Raspberry Pi SL"
},
{
"branches": [
{
"category": "product_version_range",
"name": "4.16.0.0\u003c4.17.0.0",
"product": {
"name": "CODESYS Control for WAGO Touch Panels 600 SL 4.16.0.0 \u003c 4.17.0.0",
"product_id": "CSAFPID-51015"
}
},
{
"category": "product_version",
"name": "4.17.0.0",
"product": {
"name": "CODESYS Control for WAGO Touch Panels 600 SL 4.17.0.0",
"product_id": "CSAFPID-52015"
}
}
],
"category": "product_name",
"name": "CODESYS Control for WAGO Touch Panels 600 SL"
},
{
"branches": [
{
"category": "product_version_range",
"name": "4.16.0.0\u003c4.17.0.0",
"product": {
"name": "CODESYS Virtual Control SL 4.16.0.0 \u003c 4.17.0.0",
"product_id": "CSAFPID-51016"
}
},
{
"category": "product_version",
"name": "4.17.0.0",
"product": {
"name": "CODESYS Virtual Control SL 4.17.0.0",
"product_id": "CSAFPID-52016"
}
}
],
"category": "product_name",
"name": "CODESYS Virtual Control SL"
}
],
"category": "product_family",
"name": "Software"
}
],
"category": "vendor",
"name": "CODESYS"
}
],
"product_groups": [
{
"group_id": "CSAFGID-1001",
"product_ids": [
"CSAFPID-51001",
"CSAFPID-51002",
"CSAFPID-51003",
"CSAFPID-51004",
"CSAFPID-51005"
],
"summary": "Affected products v3.5.x."
},
{
"group_id": "CSAFGID-2001",
"product_ids": [
"CSAFPID-52001",
"CSAFPID-52002",
"CSAFPID-52003",
"CSAFPID-52004",
"CSAFPID-52005"
],
"summary": "Fixed products v3.5.x."
},
{
"group_id": "CSAFGID-1002",
"product_ids": [
"CSAFPID-51006",
"CSAFPID-51007",
"CSAFPID-51008",
"CSAFPID-51009",
"CSAFPID-51010",
"CSAFPID-51011",
"CSAFPID-51012",
"CSAFPID-51013",
"CSAFPID-51014",
"CSAFPID-51015",
"CSAFPID-51016"
],
"summary": "Affected products v4.x."
},
{
"group_id": "CSAFGID-2002",
"product_ids": [
"CSAFPID-52006",
"CSAFPID-52007",
"CSAFPID-52008",
"CSAFPID-52009",
"CSAFPID-52010",
"CSAFPID-52011",
"CSAFPID-52012",
"CSAFPID-52013",
"CSAFPID-52014",
"CSAFPID-52015",
"CSAFPID-52016"
],
"summary": "Fixed products v4.x."
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-41691",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001",
"CSAFPID-52002",
"CSAFPID-52003",
"CSAFPID-52004",
"CSAFPID-52005",
"CSAFPID-52006",
"CSAFPID-52007",
"CSAFPID-52008",
"CSAFPID-52009",
"CSAFPID-52010",
"CSAFPID-52011",
"CSAFPID-52012",
"CSAFPID-52013",
"CSAFPID-52014",
"CSAFPID-52015",
"CSAFPID-52016"
],
"known_affected": [
"CSAFPID-51001",
"CSAFPID-51002",
"CSAFPID-51003",
"CSAFPID-51004",
"CSAFPID-51005",
"CSAFPID-51006",
"CSAFPID-51007",
"CSAFPID-51008",
"CSAFPID-51009",
"CSAFPID-51010",
"CSAFPID-51011",
"CSAFPID-51012",
"CSAFPID-51013",
"CSAFPID-51014",
"CSAFPID-51015",
"CSAFPID-51016"
]
},
"remediations": [
{
"category": "mitigation",
"details": "The vulnerability can be mitigated by restricting the allowed login authentication type \"CmpUserMgr/UserLogin_AuthenticationType\" to \"ONLY_ASYMMETRIC\". This can be configured either via the Device Security Settings dialog in the CODESYS Development System or directly in the configuration file of the CODESYS Control runtime system (CODESYSControl.cfg) by adding the following setting:\n\n[CmpUserMgr]\nSECURITY.UserLogin_AuthenticationType=ONLY_ASYMMETRIC\n\nWith this configuration in place, both potential attackers and legacy CODESYS protocol clients (prior to version 3.5.16.0) will be blocked from logging in, thereby preventing execution of the vulnerable code path. ",
"group_ids": [
"CSAFGID-1001",
"CSAFGID-1002"
]
},
{
"category": "vendor_fix",
"details": "Update the following products to version 3.5.21.20.\n* CODESYS Control RTE (SL)\n* CODESYS Control RTE (for Beckhoff CX) SL\n* CODESYS Control Win (SL)\n* CODESYS HMI (SL)\n* CODESYS Runtime Toolkit \n\nThe CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/. ",
"group_ids": [
"CSAFGID-2001"
]
},
{
"category": "vendor_fix",
"details": "Update the following products to version 4.17.0.0.\n* CODESYS Control for BeagleBone SL\n* CODESYS Control for emPC-A/iMX6 SL\n* CODESYS Control for IOT2000 SL\n* CODESYS Control for Linux ARM SL\n* CODESYS Control for Linux SL\n* CODESYS Control for PFC100 SL\n* CODESYS Control for PFC200 SL\n* CODESYS Control for PLCnext SL\n* CODESYS Control for Raspberry Pi SL\n* CODESYS Control for WAGO Touch Panels 600 SL\n* CODESYS Virtual Control SL\n\nThe CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/. ",
"group_ids": [
"CSAFGID-2002"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001",
"CSAFPID-51002",
"CSAFPID-51003",
"CSAFPID-51004",
"CSAFPID-51005",
"CSAFPID-51006",
"CSAFPID-51007",
"CSAFPID-51008",
"CSAFPID-51009",
"CSAFPID-51010",
"CSAFPID-51011",
"CSAFPID-51012",
"CSAFPID-51013",
"CSAFPID-51014",
"CSAFPID-51015",
"CSAFPID-51016"
]
}
],
"title": "CVE-2025-41691 "
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…