CVE-2025-41660

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-41660", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2025-04-16T11:17:48.307Z", "datePublished": "2026-03-24T07:41:43.004Z", "dateUpdated": "2026-03-24T13:16:02.920Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CODESYS Control RTE (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control RTE (for Beckhoff CX) SL", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control Win (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS HMI (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Runtime Toolkit", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for BeagleBone SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for emPC-A/iMX6 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for IOT2000 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for Linux ARM SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for Linux SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for PFC100 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for PFC200 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for PLCnext SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for Raspberry Pi SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for WAGO Touch Panels 600 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Virtual Control SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Luca Borzacchiello from Nozomi Networks"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.<br>"}], "value": "A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Spheres", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2026-03-24T07:41:43.004Z"}, "references": [{"url": "https://certvde.com/de/advisories/VDE-2026-011"}], "source": {"advisory": "VDE-2026-011", "defect": ["CERT@VDE#641802"], "discovery": "UNKNOWN"}, "title": "CODESYS Control Boot Application Replacement Enables Code Execution", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T13:15:49.570572Z", "id": "CVE-2025-41660", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T13:16:02.920Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41660", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T13:15:49.570572Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T13:15:57.857Z"}}], "cna": {"title": "CODESYS Control Boot Application Replacement Enables Code Execution", "source": {"defect": ["CERT@VDE#641802"], "advisory": "VDE-2026-011", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Luca Borzacchiello from Nozomi Networks"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CODESYS", "product": "CODESYS Control RTE (SL)", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control RTE (for Beckhoff CX) SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control Win (SL)", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS HMI (SL)", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Runtime Toolkit", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for BeagleBone SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for emPC-A/iMX6 SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for IOT2000 SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for Linux ARM SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for Linux SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for PFC100 SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for PFC200 SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for PLCnext SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for Raspberry Pi SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for WAGO Touch Panels 600 SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Virtual Control SL", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://certvde.com/de/advisories/VDE-2026-011"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.", "supportingMedia": [{"type": "text/html", "value": "A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Spheres"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2026-03-24T07:41:43.004Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41660", "state": "PUBLISHED", "dateUpdated": "2026-03-24T13:16:02.920Z", "dateReserved": "2025-04-16T11:17:48.307Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2026-03-24T07:41:43.004Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CODESYS Control RTE (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control RTE (for Beckhoff CX) SL", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control Win (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS HMI (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Runtime Toolkit", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for BeagleBone SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for emPC-A/iMX6 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for IOT2000 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for Linux ARM SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for Linux SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for PFC100 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for PFC200 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for PLCnext SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for Raspberry Pi SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for WAGO Touch Panels 600 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Virtual Control SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "source": "info@cert.vde.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution."}, {"lang": "es", "value": "Un atacante remoto de bajo privilegio podr\u00eda reemplazar la aplicaci\u00f3n de arranque del sistema de tiempo de ejecuci\u00f3n de CODESYS Control, permitiendo la ejecuci\u00f3n de c\u00f3digo no autorizado."}], "id": "CVE-2025-41660", "lastModified": "2026-06-17T09:22:54.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "info@cert.vde.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41660", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T13:15:49.570572Z", "version": "2.0.3"}}]}, "published": "2026-03-24T08:16:00.230", "references": [{"source": "info@cert.vde.com", "url": "https://certvde.com/de/advisories/VDE-2026-011"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-669"}], "source": "info@cert.vde.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,3.5.22.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "CODESYS HMI (SL)", "source": "cna", "vendor": "CODESYS"}, "product": "codesys_hmi_(sl)", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for BeagleBone SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_beaglebone_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for emPC-A/iMX6 SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_empc-a/imx6_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for IOT2000 SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_iot2000_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for Linux ARM SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_linux_arm_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for Linux SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_linux_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for PFC100 SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_pfc100_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for PFC200 SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_pfc200_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for PLCnext SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_plcnext_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for Raspberry Pi SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_raspberry_pi_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for WAGO Touch Panels 600 SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_wago_touch_panels_600_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,3.5.22.0)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "CODESYS Control RTE (SL)", "source": "cna", "vendor": "CODESYS"}, "product": "control_rte_(sl)", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,3.5.22.0)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "CODESYS Control RTE (for Beckhoff CX) SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_rte_\\(for_beckhoff_cx\\)_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,3.5.22.0)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "CODESYS Control Win (SL)", "source": "cna", "vendor": "CODESYS"}, "product": "control_win_(sl)", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,3.5.22.0)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "CODESYS Runtime Toolkit", "source": "cna", "vendor": "CODESYS"}, "product": "runtime_toolkit", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "CODESYS Virtual Control SL", "source": "cna", "vendor": "CODESYS"}, "product": "virtual_control_sl", "vendor": "codesys"}], "analysis": {"en": {"generated_at": "2026-03-24T09:21:20.753504+00:00", "value": {"mitigation_remediation": ["Obtain and apply the latest vendor patch or upgrade that removes the vulnerability.", "Restrict remote access to the CODESYS Control runtime by limiting connections to trusted networks or applying firewall rules.", "Disable or lock the boot application directory or files to prevent unauthorized modification.", "Enforce strict role\u2011based access controls so that only privileged users can modify boot configuration files.", "Monitor system logs for any abnormal attempts to change boot application files.", "If a patch is not yet available, consider isolating the device from untrusted networks and restricting physical access."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects multiple CODESYS Control products, including CODESYS Control RTE for standard Linux (SL) and Beckhoff CX, CODESYS Control Win (SL), CODESYS Control for BeagleBone, IOT2000, Linux ARM, generic Linux, PFC100, PFC200, PLCnext, Raspberry Pi, WAGO Touch Panels 600, emPC\u2011A/iMX6, as well as the CODESYS HMI, Runtime Toolkit, and Virtual Control SL editions.", "description_and_impact": "A low\u2011privileged remote attacker may replace the boot application of the CODESYS Control runtime system. This replacement allows the attacker to run arbitrary code when the device boots, effectively granting full control over the system. The weakness involves unauthorized modification of a critical component (CWE\u2011669).", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity vulnerability, and although EPSS data is not available, the vulnerability is exploitable by an attacker with low privileges. The attack vector is likely remote, inferred from the description that a remote attacker can replace the boot application. The vulnerability is not yet listed in the CISA KEV catalog, but its high impact and remote nature warrant immediate attention."}}}}, "created": "2026-03-25T11:48:53.833100+00:00", "updated": "2026-03-25T20:39:48.708485+00:00", "vendors": ["codesys", "codesys$PRODUCT$codesys_hmi_(sl)", "codesys$PRODUCT$control_for_beaglebone_sl", "codesys$PRODUCT$control_for_empc-a/imx6_sl", "codesys$PRODUCT$control_for_iot2000_sl", "codesys$PRODUCT$control_for_linux_arm_sl", "codesys$PRODUCT$control_for_linux_sl", "codesys$PRODUCT$control_for_pfc100_sl", "codesys$PRODUCT$control_for_pfc200_sl", "codesys$PRODUCT$control_for_plcnext_sl", "codesys$PRODUCT$control_for_raspberry_pi_sl", "codesys$PRODUCT$control_for_wago_touch_panels_600_sl", "codesys$PRODUCT$control_rte_(sl)", "codesys$PRODUCT$control_rte_\\(for_beckhoff_cx\\)_sl", "codesys$PRODUCT$control_win_(sl)", "codesys$PRODUCT$runtime_toolkit", "codesys$PRODUCT$virtual_control_sl"]}