What is the CVSS score of CVE-2026-3509?

CVE-2026-3509 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Codesys Control Rte Sl are affected by CVE-2026-3509?

CVE-2026-3509 is a format string vulnerability in CODESYS Control runtime systems that allows unauthenticated attackers to crash industrial control systems across multiple platforms, including…. A patch is available.

How to fix or mitigate CVE-2026-3509?

Within 24 hours: Identify all CODESYS Control installations in your environment using asset inventory and network scanning; notify relevant operations and engineering teams of exposure. Within 7 days: Apply vendor-released patch to all affected CODESYS Control instances; prioritize systems in production and critical operational networks first. Within 30 days: Verify patch application across the full estate; conduct network segmentation audit to restrict unauthenticated access to CODESYS Control audit log interfaces where technically feasible.

Codesys Control Rte Sl CVE-2026-3509

EUVD-2026-14784 HIGH

Use of Externally-Controlled Format String (CWE-134)

2026-03-24 CERTVDE

GHSA-34rr-qp2j-p4q7

Information Disclosure Codesys Control Rte Sl Codesys Control Rte For Beckhoff Cx Sl Codesys Control Win Sl Codesys Runtime Toolkit Codesys Control For Beaglebone Sl Codesys Control For Empc A Imx6 Sl Codesys Control For Iot2000 Sl Codesys Control For Linux Arm Sl Codesys Control For Linux Sl Codesys Control For Pfc100 Sl Codesys Control For Pfc200 Sl Codesys Control For Plcnext Sl Codesys Control For Raspberry Pi Sl Codesys Control For Wago Touch Panels 600 Sl Codesys Virtual Control Sl

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:18 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.21.0.0,3.5.22.0

EUVD ID Assigned

Mar 24, 2026 - 08:00 euvd

EUVD-2026-14784

Analysis Generated

Mar 24, 2026 - 08:00 vuln.today

CVE Published

Mar 24, 2026 - 07:42 nvd

HIGH 7.5

DescriptionCVE.org

An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.

AnalysisAI

A format string vulnerability exists in the Audit Log component of CODESYS Control runtime system that allows unauthenticated remote attackers to inject malicious format specifiers into log messages. This affects numerous CODESYS Control products across multiple platforms including Windows, Linux, embedded systems (BeagleBone, Raspberry Pi, PFC100/200), and industrial controllers (Beckhoff CX, WAGO Touch Panels). Exploitation can lead to denial-of-service conditions by crashing the runtime system, with a CVSS score of 7.5 indicating high availability impact.

Technical ContextAI

This vulnerability stems from CWE-134 (Use of Externally-Controlled Format String), where user-controlled input is passed directly to format string functions without proper sanitization in the CODESYS Control runtime's Audit Log mechanism. CODESYS is a widely-deployed industrial automation development platform used in programmable logic controllers (PLCs) and embedded control systems. The affected products span the entire CODESYS Control family including runtime environments (RTE), development toolkits, platform-specific implementations for ARM and x86 Linux, Windows, and vendor-specific variants for industrial hardware from Beckhoff, WAGO, Phoenix Contact (PLCnext), and others. Format string vulnerabilities occur when attacker-supplied data containing format specifiers like %s, %n, or %x is processed by functions like printf, syslog, or similar logging functions, potentially causing crashes, memory corruption, or information disclosure depending on implementation.

RemediationAI

Consult the CERT@VDE security advisory VDE-2026-018 at https://certvde.com/de/advisories/VDE-2026-018 for vendor-provided patches and specific version updates that address this format string vulnerability. Until patches can be applied, implement network segmentation to restrict access to CODESYS runtime systems from untrusted networks, disable or restrict remote access to audit log functionality if operationally feasible, and deploy intrusion detection systems to monitor for format string attack patterns in network traffic targeting CODESYS services. Given the unauthenticated remote attack vector, prioritize applying vendor patches as soon as they become available and conduct thorough testing in non-production environments before deploying to operational industrial control systems. Organizations should also review audit log configurations to minimize exposure of log processing interfaces to external networks.