EUVD-2026-31266
GHSA-ch6f-rrj9-8j2m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low complexity; PR:L for required low-privileged account; UI:R captures concurrent victim login dependency; C:H for full credential disclosure with no integrity or availability impact.
Primary rating from Vendor (CERTVDE).
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
3DescriptionCVE.org
The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolation of authentication data. The vulnerability affects only login operations within an active visualization session.
AnalysisAI
CODESYS Visualization (versions 1.0.0.0 through below 4.10.0.0) exposes authentication credentials of one low-privileged user to another during concurrent login operations, caused by insufficient isolation of authentication data within active visualization sessions. The flaw is exploitable remotely but requires low-privileged access and a concurrent login event by another user, limiting realistic attack surface. No public exploit code exists and SSVC confirms exploitation status as none; EPSS of 0.05% (15th percentile) reflects negligible near-term exploitation likelihood.
Technical ContextAI
CODESYS is a widely adopted IEC 61131-3 compliant industrial automation development platform used across PLCs, HMIs, and control systems; the affected component is its visualization subsystem (CPE: cpe:2.3:a:codesys:visualization:*:*:*:*:*:*:*:*). The root cause is classified as CWE-522 (Insufficiently Protected Credentials), which describes failure to adequately protect credentials stored or transmitted in memory or transit. In this case, authentication session data is not properly isolated between simultaneous login processes, creating a window in which one user's credentials can bleed into another session context. This is consistent with a shared memory or session-state race condition during the authentication handshake within active visualization sessions, not a general-purpose attack surface across the entire CODESYS runtime.
RemediationAI
Upgrade CODESYS Visualization to version 4.10.0.0 or later, which is confirmed as the fixed release per the CERTVDE advisory at https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-07_vde-2026-052.json. Vendor-released patch is available. Where immediate patching is not feasible, restrict simultaneous visualization login sessions by enforcing single-session policies at the application or network level; this eliminates the concurrent login precondition required for exploitation but may impact multi-operator workflows. Additionally, network-segment the CODESYS visualization interface behind OT DMZ controls or VPN to reduce the pool of potential low-privileged attackers who could exploit concurrent sessions. Treat any credentials used with affected visualization instances as potentially compromised and rotate them after patching.
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. Rated critica
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. Rated
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service con
An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH COD
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODE
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of C
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality o
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality o
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionalit
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before insta
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid reque
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today