What is the CVSS score of EUVD-2025-208957?

EUVD-2025-208957 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Codesys Control Rte Sl are affected by EUVD-2025-208957?

CVE-2025-41660 affects CODESYS Control runtime systems across industrial automation platforms, enabling low-privileged remote attackers to execute arbitrary code by replacing boot applications.. A patch is available.

How to fix or mitigate EUVD-2025-208957?

Within 24 hours: Identify all CODESYS Control installations across your environment (Linux, Windows, and embedded systems) and document current versions; contact CODESYS vendor for confirmed affected version list and patch availability status. Within 7 days: Apply vendor-released patch to all affected CODESYS Control systems; prioritize internet-facing or network-accessible instances. Within 30 days: Complete patching of all remaining CODESYS Control deployments; conduct post-patch verification testing in operational environments.

Codesys Control Rte Sl EUVD-2025-208957

| CVE-2025-41660 HIGH

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-03-24 CERTVDE

GHSA-25xg-52c8-p9q8

RCE Codesys Control Rte Sl Codesys Control Rte For Beckhoff Cx Sl Codesys Control Win Sl Codesys Hmi Sl Codesys Runtime Toolkit Codesys Control For Beaglebone Sl Codesys Control For Empc A Imx6 Sl Codesys Control For Iot2000 Sl Codesys Control For Linux Arm Sl Codesys Control For Linux Sl Codesys Control For Pfc100 Sl Codesys Control For Pfc200 Sl Codesys Control For Plcnext Sl Codesys Control For Raspberry Pi Sl Codesys Control For Wago Touch Panels 600 Sl Codesys Virtual Control Sl

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:18 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.21.0.0,3.5.22.0

EUVD ID Assigned

Mar 24, 2026 - 08:00 euvd

EUVD-2025-208957

Analysis Generated

Mar 24, 2026 - 08:00 vuln.today

CVE Published

Mar 24, 2026 - 07:41 nvd

HIGH 8.8

DescriptionCVE.org

A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.

AnalysisAI

A vulnerability in CODESYS Control runtime systems allows a low-privileged remote attacker to replace the boot application, resulting in arbitrary code execution with high impact on confidentiality, integrity, and availability. The vulnerability affects numerous CODESYS Control variants across multiple platforms including Linux, Windows, embedded systems, and industrial controllers. With a CVSS score of 8.8 and network-accessible attack vector requiring only low privileges, this represents a significant threat to industrial control systems and automation environments.

Technical ContextAI

CODESYS Control is a widely-deployed runtime system for programmable logic controllers (PLCs) and industrial automation devices. This vulnerability stems from CWE-669 (Incorrect Resource Transfer Between Spheres), indicating improper isolation or validation when handling boot application components. The affected products span the entire CODESYS ecosystem including Control RTE (Runtime Environment), Control Win, HMI, and Runtime Toolkit, as well as platform-specific implementations for Beckhoff CX controllers, BeagleBone, Raspberry Pi, WAGO Touch Panels, Linux ARM systems, IOT2000 devices, and PLCNext controllers. The boot application replacement mechanism lacks sufficient authorization checks, allowing authenticated users with low privileges to substitute legitimate boot code with malicious payloads that execute during system startup with elevated privileges.

RemediationAI

Organizations should immediately consult the CERT@VDE advisory at https://certvde.com/de/advisories/VDE-2026-011 for specific patching guidance and affected version details from CODESYS. Apply vendor-provided security updates as soon as they become available for all affected CODESYS Control runtime installations. Until patches can be deployed, implement compensating controls including restricting network access to CODESYS runtime systems using firewall rules that permit connections only from authorized engineering workstations and management systems, enforcing strong authentication with multi-factor authentication where possible, conducting audits of user privilege assignments to ensure least-privilege principles, monitoring for unauthorized boot application modifications through file integrity monitoring, and disabling remote access capabilities if not operationally required. Consider network segmentation to isolate industrial control systems from corporate networks and the internet.