Codesys EUVD-2026-14784

Requires CODESYS Control runtime system with Audit Log enabled and accessible over the network. Remote unauthenticated attacker can send crafted messages exploiting format string vulnerability in Audit Log message processing to cause denial-of-service.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates this is a network-exploitable vulnerability requiring low attack complexity with no authentication, making it highly accessible to attackers. The high availability impact suggests reliable DoS exploitation against industrial control systems, which is particularly concerning given CODESYS's widespread deployment in critical infrastructure and manufacturing environments. While the vulnerability is limited to availability impact (no confidentiality or integrity compromise indicated), denial-of-service against industrial control systems can have severe operational and safety consequences. The vulnerability was reported by CERT@VDE, a specialized CERT for automation and control systems in Germany, suggesting real-world relevance to industrial environments. No EPSS score or KEV listing is provided in the available data, and no public proof-of-concept is mentioned, but the low attack complexity and unauthenticated network access vector make exploitation straightforward for attackers familiar with format string attacks. Organizations running affected CODESYS runtime systems with network-accessible audit logging should prioritize remediation.

An unauthenticated attacker on the network identifies a CODESYS Control runtime system with accessible audit logging functionality, then crafts malicious network requests containing format string specifiers (such as %n, %s, or multiple %x sequences) that are processed by the audit log mechanism. When the CODESYS runtime processes these malicious format strings during log generation, the vulnerability triggers memory corruption or an exception condition that crashes the control runtime, causing a denial-of-service that halts industrial automation processes. The low attack complexity and lack of authentication requirements mean exploitation can be automated and deployed against multiple targets in industrial networks, particularly during reconnaissance scans of OT environments.