CVE-2025-41691

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-41691", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2025-04-16T11:17:48.309Z", "datePublished": "2025-08-04T08:04:34.981Z", "dateUpdated": "2025-08-04T16:32:30.773Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Control RTE (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control RTE (for Beckhoff CX) SL", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control Win (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "HMI (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for BeagleBone SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for emPC-A/iMX6 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for IOT2000 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for Linux ARM SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for Linux SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for PFC100 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for PFC200 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for PLCnext SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for Raspberry Pi SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for WAGO Touch Panels 600 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Virtual Control SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.<br>"}], "value": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-08-04T08:04:34.981Z"}, "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-070"}], "source": {"advisory": "VDE-2025-070", "defect": ["CERT@VDE#641834"], "discovery": "UNKNOWN"}, "title": "CODESYS Control DoS via Unauthenticated NULL Pointer Dereference", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-04T16:28:09.392670Z", "id": "CVE-2025-41691", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T16:32:30.773Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41691", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-04T16:28:09.392670Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T16:29:30.560Z"}}], "cna": {"title": "CODESYS Control DoS via Unauthenticated NULL Pointer Dereference", "source": {"defect": ["CERT@VDE#641834"], "advisory": "VDE-2025-070", "discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CODESYS", "product": "Control RTE (SL)", "versions": [{"status": "affected", "version": "3.5.21.10", "lessThan": "3.5.21.20", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control RTE (for Beckhoff CX) SL", "versions": [{"status": "affected", "version": "3.5.21.10", "lessThan": "3.5.21.20", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control Win (SL)", "versions": [{"status": "affected", "version": "3.5.21.10", "lessThan": "3.5.21.20", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "HMI (SL)", "versions": [{"status": "affected", "version": "3.5.21.10", "lessThan": "3.5.21.20", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for BeagleBone SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for emPC-A/iMX6 SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for IOT2000 SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for Linux ARM SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for Linux SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for PFC100 SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for PFC200 SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for PLCnext SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for Raspberry Pi SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for WAGO Touch Panels 600 SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Virtual Control SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-070"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.", "supportingMedia": [{"type": "text/html", "value": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-08-04T08:04:34.981Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41691", "state": "PUBLISHED", "dateUpdated": "2025-08-04T16:32:30.773Z", "dateReserved": "2025-04-16T11:17:48.309Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2025-08-04T08:04:34.981Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Control RTE (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control RTE (for Beckhoff CX) SL", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control Win (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "HMI (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for BeagleBone SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for emPC-A/iMX6 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for IOT2000 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for Linux ARM SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for Linux SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for PFC100 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for PFC200 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for PLCnext SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for Raspberry Pi SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for WAGO Touch Panels 600 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Virtual Control SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}], "source": "info@cert.vde.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition."}, {"lang": "es", "value": "Un atacante remoto no autenticado puede provocar una desreferencia de puntero NULL en los sistemas de ejecuci\u00f3n de CODESYS Control afectados mediante el env\u00edo de solicitudes de comunicaci\u00f3n especialmente manipuladas, lo que podr\u00eda conducir a una condici\u00f3n de denegaci\u00f3n de servicio (DoS)."}], "id": "CVE-2025-41691", "lastModified": "2026-06-17T09:22:58.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "info@cert.vde.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41691", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-04T16:28:09.392670Z", "version": "2.0.3"}}]}, "published": "2025-08-04T08:15:48.353", "references": [{"source": "info@cert.vde.com", "url": "https://certvde.com/de/advisories/VDE-2025-070"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "info@cert.vde.com", "type": "Secondary"}]}

{}

{"created": "2025-08-05T11:38:57.957367+00:00", "updated": "2025-08-05T11:38:57.957418+00:00", "vendors": ["codesys", "codesys$PRODUCT$control"]}