EUVD-2026-31798
GHSA-x347-p9xc-q762
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account on engineering host
-
DeliveryWait for administrator to launch CODESYS install
-
ExploitWrite malicious component manifest into world-writable temp directory
-
ExecutionElevated installer reads attacker-controlled manifest
-
PersistInstaller deploys arbitrary components as admin
-
ImpactAchieve SYSTEM-level code execution on OT workstation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Default permission hardening
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) an existing low-privileged local account on the host running CODESYS Development System 3.0.0.0-3.5.22.19, (2) an administrative installation of CODESYS being performed or in progress on that host - the vulnerable insecure-permission directory and temporary component manifest only exist during/after an admin install, and (3) the ability to write to that install working directory before the elevated installer reads the manifest. Limiting factors: the CVSS 4.0 vector is AV:L (no remote exploitation), the attacker must already hold local credentials (PR:L), and exploitation is tied to the install workflow rather than steady-state runtime, which is why SSVC marks it not automatable. |
| Impact | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H/VA:H scores 8.5 and reflects a reliable local-only attack by an already-authenticated low-privileged user, with no user interaction and no special attack requirements. SSVC corroborates this: technical impact total, but exploitation 'none' and automatable 'no', and EPSS is 0.01% (1st percentile) - consistent with a privilege-escalation primitive that is only useful post-foothold rather than a mass-exploitable internet bug. This is not in CISA KEV and no public PoC is referenced, so it should be triaged as a meaningful hardening priority for any host running CODESYS - especially engineering workstations that double as user endpoints - but it is not an emergency for internet-facing assets. |
| Exploit ScenarioDerived | An attacker with an unprivileged interactive session on an engineering workstation waits for (or socially engineers) an administrator to launch the CODESYS installer, then writes a modified component manifest into the predictably named, world-writable temporary directory before the elevated installer consumes it. The installer obediently deploys the attacker-chosen components with administrative privileges, giving the attacker SYSTEM-level code execution on the OT engineering host. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Local privilege escalation in CODESYS Development System versions 3.0.0.0 through 3.5.22.20 allows low-privileged users on a Windows host to tamper with a temporary component manifest written during administrative installation, forcing deployment of attacker-chosen components with elevated rights. The flaw stems from insecure default permissions (CWE-276) on a directory used during install and was reported by CERT@VDE. EPSS is 0.01% and SSVC reports no observed exploitation, so this is a high-impact but currently low-prevalence local issue.
RemediationAI
Vendor-released patch: CODESYS Development System 3.5.22.20 or later - upgrade per the CERT@VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-055/. Until the upgrade is rolled out across engineering workstations, restrict administrative installation of CODESYS to dedicated provisioning machines that no untrusted local user can log into, and after installation manually tighten the ACLs on the CODESYS install/working directory to remove write/modify rights for non-administrators (side effect: subsequent component installs may need to be re-run from an elevated session). Where possible, prevent low-privileged users from triggering installs entirely by removing them from local groups that can launch elevated installers, and monitor file integrity on the component manifest path during install windows; avoid leaving partially completed installs on shared multi-user hosts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CODESYS Development System is the IEC 61131-3 engineering workstation used to program PLCs and industrial controllers across many OEM brands (Beckhoff, Wago, Schneider OEMs, etc.), so it is commonly deployed on engineering laptops in OT environments. During administrative installation the installer creates a working directory with overly permissive default ACLs (CWE-276 - Incorrect Default Permissions); a temporary file inside this directory describes which components will be installed. Because the directory inherits world-writable or user-writable permissions, an unprivileged local account can race or pre-position a modified manifest before the elevated installer consumes it, causing it to deploy arbitrary components in the SYSTEM/admin context.
Know when Codesys gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (CERTVDE) · only source for this CVE.
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
2DescriptionCVE.org
The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation by forcing the deployment of arbitrary components.
Executive ViewAI
CODESYS Development System versions 3.0.0.0 through 3.5.22.20 are vulnerable to local privilege escalation attacks that allow low-privileged users to gain administrative rights on development systems. The vulnerability poses a significant insider threat and supply-chain risk in manufacturing and industrial control environments, as compromised development systems could be used to inject malicious components into distributed products.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. Rated critica
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. Rated
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service con
An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH COD
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODE
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of C
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality o
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality o
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionalit
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before insta
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid reque
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the
Exploit-DB