CODESYS Control EUVD-2026-31799

Attacker must hold valid credentials for a low-privileged user account on the CODESYS runtime (PR:L) and have network reachability to the runtime's management service, typically the CODESYS V3 communication channel on the controller. The vulnerable user-deletion code path exists in default configurations of affected SL runtime versions whenever the user-management feature is enabled - which is the standard configuration once any authentication has been provisioned. No user interaction is required (UI:N) and no special non-default settings are needed, but exploitation is limited to environments where (a) the runtime is exposed to a network the attacker can reach (commonly an OT or engineering VLAN, not the internet) and (b) at least one low-privileged account already exists for the attacker to use.

The CVSS 4.0 base score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N) reflects network-reachable exploitation by an already-authenticated low-privileged user with no user interaction, yielding high integrity and availability impact (VI:H/VA:H) but no confidentiality loss - consistent with destructive account tampering rather than data theft. EPSS is very low at 0.10% (26th percentile) and CISA SSVC scores exploitation as 'none', automatable 'no', technical impact 'partial', so this is not a mass-exploitation candidate. However, in OT/ICS environments the realistic threat is significant: deleting the administrator account on a running PLC can lock out legitimate operators, force emergency on-site recovery, and disrupt production - so the practical priority is higher than the EPSS percentile suggests, particularly for plants exposing CODESYS runtimes on shared corporate networks. Signals are internally consistent; the main caveat is that no public PoC is available and SSVC reports 'exploitation: none', so prioritization should be driven by exposure and patch windows rather than active threat indicators.

An attacker who has obtained or been issued any low-privileged CODESYS runtime account (for example, a maintenance or read-only operator role) connects over the network to the runtime's user-management interface and issues a delete-user request targeting the administrator account; the runtime authenticates the caller but fails to authorize the action and removes the admin. The result is loss of legitimate administrative control of the PLC/HMI, which in ICS contexts may require on-site recovery and halt production. No public exploit is identified at time of analysis, so realistic abuse would require an attacker to develop the request against the documented runtime protocol.