Codesys EUVD-2025-208957

This vulnerability presents significant real-world risk despite requiring authenticated access. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network accessibility with low attack complexity and no user interaction required, making exploitation straightforward once low-privilege credentials are obtained. In industrial environments, low-privilege accounts are common for monitoring, reporting, and basic operations, providing numerous potential entry points. The ability to replace boot applications enables persistent compromise that survives reboots and could bypass integrity checks, making this particularly dangerous in critical infrastructure contexts. The vulnerability affects core CODESYS runtime components used across hundreds of industrial automation vendors, amplifying the potential attack surface. While no EPSS score or KEV status is provided in the intelligence, the combination of network accessibility, low complexity, and complete system compromise capability (RCE with H/H/H impact) makes this a genuine priority requiring immediate attention in operational technology environments.

An attacker obtains credentials for a low-privileged CODESYS Control user account through phishing, credential stuffing, or exploiting default credentials common in industrial environments. The attacker remotely connects to the CODESYS runtime system over the network and exploits the insufficient authorization checks to upload a malicious boot application, replacing the legitimate one. Upon the next system restart (scheduled maintenance, power cycle, or attacker-induced reboot), the malicious boot application executes with elevated privileges, establishing persistent backdoor access and enabling the attacker to manipulate industrial processes, exfiltrate sensitive operational data, or deploy ransomware across the automation network.