EUVD-2026-31800
GHSA-x9mr-w23g-rxq7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (CERTVDE) · only source for this CVE.
CVSS VectorVendor: CERTVDE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device.
AnalysisAI
Denial of service in CODESYS Control runtime products and HMI/Toolkit components allows unauthenticated remote attackers to crash affected industrial control systems by sending malformed HTTP requests that trigger a size-limited out-of-bounds write during length parsing. The flaw affects a broad range of CODESYS runtime variants used across PLCs, industrial PCs, and embedded controllers from vendors like Beckhoff, WAGO, and Raspberry Pi-based deployments. No public exploit identified at time of analysis, EPSS is low (0.07%), but the network-reachable, no-privileges-required attack surface makes this operationally significant for OT environments.
Technical ContextAI
The vulnerability resides in CODESYS runtime components (Control RTE, Control Win, HMI, Runtime Toolkit, and the Control for X SL family) which expose an HTTP interface for engineering and management. CWE-1284 (Improper Validation of Specified Quantity in Input) describes the root cause: the HTTP request parser fails to correctly validate length fields before writing to a fixed buffer, producing a bounded out-of-bounds write. Because the write is size-limited (not attacker-controlled large), the practical effect is memory corruption that crashes the runtime process rather than enabling code execution. CODESYS runtimes are deployed on Linux ARM/x86, Windows, and bare-metal RTE configurations across PLCs and industrial gateways, making the affected codebase widespread in OT/ICS networks.
RemediationAI
Upgrade to CODESYS Control RTE/Win/HMI/Runtime Toolkit version 3.5.22.20 or later for the 3.5.x branch, and to version 4.21.0.0 or later for all Control for X SL products and Virtual Control SL. The vendor-released patch is referenced in CERT@VDE advisory VDE-2026-057 (https://www.certvde.com/en/advisories/VDE-2026-057/). Where patching cannot be performed immediately on production controllers, restrict network reachability of the CODESYS runtime HTTP/management ports to engineering workstations only via firewall ACLs or VLAN segmentation - this is effective because the attack vector is network-only and unauthenticated, but it will break any legitimate remote engineering access until allowlists are configured. Disabling the HTTP-accessible runtime interface where the deployment does not require it is another option, with the trade-off that web-based HMI and remote programming via CODESYS tooling will be unavailable. Monitoring for unexpected runtime restarts can serve as a detection signal.
More in Codesys Control Rte Sl
View allA vulnerability in CODESYS Control runtime systems allows a low-privileged remote attacker to replace the boot applicati
A format string vulnerability exists in the Audit Log component of CODESYS Control runtime system that allows unauthenti
Privilege escalation through unauthorized account deletion in CODESYS Control runtime products (versions below 3.5.22.20
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today