CODESYS Development System EUVD-2026-31797

Exploitation requires a local low-privileged account (CVSS PR:L) on a host where an administrator is actively performing a CODESYS Development System administrative installation or upgrade of an affected version (3.0.0.0 through 3.5.22.19); no user interaction by the attacker's victim beyond running the install is needed (UI:N). The attacker must win a TOCTOU race in the installer's temp-extraction directory, which the description characterizes as having 'a practical time window' - meaning success is not guaranteed on a single attempt and depends on the attacker already having code running on the box at install time. The bug does not apply to non-administrative installs or to systems where the install temp directory's default permissions have been tightened, and it cannot be triggered remotely (AV:L).

CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H yields a base of 8.5, reflecting local-only attack with low privileges but full confidentiality, integrity, and availability impact on the vulnerable component. EPSS is only 0.01% (1st percentile) and CISA SSVC reports Exploitation: none, Automatable: no, Technical Impact: total, which is consistent with no KEV listing and no public PoC - this is a high-impact but presently low-likelihood issue. The local attack vector and required low-privilege foothold meaningfully limit mass exploitation, but on engineering workstations in ICS environments the impact is severe because escalation to admin on a programming PC translates to control over PLC project trust. Note the apparent tension between 'AC:L' (low complexity) and the description's reliance on a race-condition window - exploitation is realistically race-dependent, so AC:L should be treated as best-case for the attacker, not guaranteed first-try success.

An attacker with an ordinary user account on a shared engineering workstation waits for (or socially engineers) an administrator to launch a CODESYS Development System install or update. While the installer extracts files into the world-writable temp directory and performs its integrity checks, the attacker's pre-positioned script monitors the directory and replaces a verified file with a malicious DLL or EXE between the check and the elevated execution, gaining SYSTEM/Administrator code execution on the engineering PC.