CVE-2026-79625

Improper Synchronization in Monitoring in CODESYS Control Runtime

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a/imx6 Sl Control For Iot2000 Sl and 15 more

CVE-2022-47390

CODESYS: Multiple products prone to stack based out-of-bounds write

An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 14 more

CVE-2022-47389

CODESYS: Multiple products prone to stack based out-of-bounds write

An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 14 more

CVE-2022-4224

CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3

In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 13 more

CVE-2026-8047

Out-of-bounds Write in CODESYS Control

The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Codesys

Products

Codesys Control For Beaglebone Sl Codesys Control For Empc A Imx6 Sl Codesys Control For Iot2000 Sl and 29 more

CVE-2026-8046

Incorrect Authorization in CODESYS Control

The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Codesys

Products

Codesys Control For Beaglebone Sl Codesys Control For Empc A Imx6 Sl Codesys Control For Iot2000 Sl and 29 more

CVE-2024-8175

CODESYS: web server vulnerable to DoS

An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 15 more

CVE-2025-41739

CODESYS Control - Linux/QNX SysSocket flaw

An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a denial of service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Codesys Linux

Products

Control For Beaglebone Sl Control For Empc-a/imx6 Sl Control For Iot2000 Sl and 14 more

CVE-2026-3509

CODESYS Control Audit Log Format String DoS

An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a/imx6 Sl Control For Iot2000 Sl and 12 more

CVE-2025-41660

CODESYS Control Boot Application Replacement Enables Code Execution

A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Codesys

Products

Codesys Hmi (sl) Control For Beaglebone Sl Control For Empc-a/imx6 Sl and 13 more

CVE-2025-41738

CODESYS Control - Invalid type usage in visualization

An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a/imx6 Sl Control For Empc-a\/imx6 Sl and 19 more

CVE-2022-47393

CODESYS: Multiple products prone to improperly restricted memory operations

An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 14 more

CVE-2022-47392

CODESYS: Multiple products prone to Improper Input Validation

An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 14 more

CVE-2022-47391

CODESYS: Multiple products prone to Improper Input Validation

In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 14 more

CVE-2022-47388

CODESYS: Multiple products prone to stack based out-of-bounds write

An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 14 more

CVE-2022-47387

CODESYS: Multiple products prone to stack based out-of-bounds write

An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 14 more

CVE-2022-47386

CODESYS: Multiple products prone to stack based out-of-bounds write

An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 14 more

CVE-2022-47385

CODESYS: Multiple products prone to stack based out-of-bounds write

An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 14 more

CVE-2022-47384

CODESYS: Multiple products prone to stack based out-of-bounds write

An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 14 more

CVE-2022-47383

CODESYS: Multiple products prone to stack based out-of-bounds write

An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Codesys

Products

Control For Beaglebone Sl Control For Empc-a\/imx6 Sl Control For Iot2000 Sl and 14 more