EUVD-2026-25222
GHSA-c7pv-j8xr-mmhj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network connection flood (AV:N/AC:L/PR:N/UI:N) with impact limited to service availability (A:H), no confidentiality or integrity effect and no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter stack, preventing legitimate clients from establishing new connections.
AnalysisAI
Denial of service in the CODESYS EtherNet/IP adapter stack (versions 1.0.0.0 up to but not including 4.9.0.0) lets an unauthenticated remote attacker exhaust all available TCP connections, blocking legitimate EtherNet/IP clients from establishing new sessions. The flaw is remotely reachable with no authentication or user interaction (CVSS 4.0 8.7, VA:H). No public exploit has been identified at time of analysis and EPSS is low (0.14%), but CISA SSVC rates it automatable with partial technical impact.
Technical ContextAI
CODESYS EtherNet/IP is an industrial protocol stack that implements the EtherNet/IP adapter (server) role on top of CIP over TCP/IP, commonly embedded in PLCs, controllers, and industrial gateways built on the CODESYS runtime. The affected component is identified by CPE cpe:2.3:a:codesys:codesys_ethernetip:*. The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions): the adapter stack does not properly bound or reclaim incoming TCP connection resources, so a flood of connection attempts consumes the finite connection pool and is never released, starving legitimate clients. This is an availability/resource-exhaustion weakness in the network-facing connection handling, not a memory-corruption or code-execution bug.
RemediationAI
Patch available per vendor advisory: upgrade the CODESYS EtherNet/IP adapter stack to version 4.9.0.0 or later, which is the first release outside the affected range (1.0.0.0 <4.9.0.0); follow the fixed-version and update guidance in CERT@VDE advisory VDE-2026-040 at https://www.certvde.com/en/advisories/VDE-2026-040/ and the CSAF document at https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-04_vde-2026-040.json. Where immediate patching of OT devices is not feasible, restrict network reachability of the EtherNet/IP adapter: place affected controllers behind an industrial firewall and permit TCP to the EtherNet/IP port (typically 44818) only from known engineering/SCADA hosts, which prevents arbitrary clients from opening connections but requires an accurate inventory of legitimate peers. Consider connection rate-limiting or per-source connection caps at an upstream firewall to blunt floods, accepting that aggressive limits may drop bursts of legitimate polling. Enforce OT network segmentation so the adapter is never exposed to corporate or internet-facing networks.
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. Rated critica
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. Rated
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service con
An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH COD
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODE
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of C
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality o
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality o
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionalit
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before insta
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid reque
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today