EUVD-2026-31797
GHSA-fhx5-27vm-6mqj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (CERTVDE) · only source for this CVE.
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
3DescriptionCVE.org
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation.
AnalysisAI
Local privilege escalation in CODESYS Development System versions 3.0.0.0 through 3.5.22.19 allows a low-privileged local attacker to win a TOCTOU race condition during administrative installation, swapping verified installer files for malicious ones before they execute with elevated rights. The flaw stems from insecure default permissions on the temporary extraction directory used by the installer. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.01%, 1st percentile).
Technical ContextAI
CODESYS Development System is the integrated development environment used to program IEC 61131-3 PLCs across many industrial automation vendors, so it is widely deployed on engineering workstations in OT/ICS environments (CPE: cpe:2.3:a:codesys:codesys_development_system). The root cause is CWE-276 (Incorrect Default Permissions): during administrative install, the installer extracts files to a temp directory that is writable by lower-privileged users, creating a time-of-check-to-time-of-use (TOCTOU) gap between signature/integrity validation and execution. Because the installer ultimately runs the extracted binaries with administrator privileges, an attacker who wins the race substitutes attacker-controlled code into the elevated execution path.
RemediationAI
Vendor-released patch: upgrade CODESYS Development System to 3.5.22.20 or later, as documented in the CERT@VDE advisory VDE-2026-055 (https://www.certvde.com/en/advisories/VDE-2026-055/). Until the upgrade can be deployed, only perform installations from accounts where no other low-privileged users are concurrently logged on the same host, and restrict interactive logon to engineering workstations so that an attacker cannot pre-position a process that races the installer; on shared workstations, harden the default ACL of the system temp directory (e.g., remove write access for non-administrative users) - note this can break other installers and applications that legitimately use per-user temp paths, so test before broad rollout. Application allowlisting (e.g., WDAC/AppLocker) on the engineering workstation will not stop the elevation by itself because the installer is trusted, but it reduces the value of a successful escalation by limiting what attacker-supplied binaries can run.
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. Rated critica
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. Rated
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service con
An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH COD
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODE
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of C
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality o
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality o
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionalit
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before insta
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid reque
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today