Which versions of CODESYS Control are affected by EUVD-2026-31800?

CODESYS Control runtime products used in industrial automation systems from Beckhoff, WAGO, and embedded deployments are vulnerable to denial-of-service attacks by unauthenticated remote attackers.. A patch is available.

How to fix or mitigate EUVD-2026-31800?

Within 24 hours: Inventory all CODESYS Control runtime and HMI/Toolkit instances; prioritize identification of internet-exposed or network-accessible deployments. Within 7 days: Apply vendor-released patches to all affected CODESYS products; test in staging environment to confirm functionality before production rollout. Within 30 days: Complete patch deployment across all production and non-production instances; validate no vulnerable versions remain through scanning or vendor verification tools.

CODESYS Control EUVD-2026-31800

Q: What is the CVSS score of EUVD-2026-31800?

EUVD-2026-31800 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-8047 HIGH

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-05-26 CERTVDE

GHSA-x9mr-w23g-rxq7

8.7

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERTVDE) · only source for this CVE.

CVSS VectorVendor: CERTVDE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:21 vuln.today

CVSS changed

May 26, 2026 - 13:37 NVD

7.5 (HIGH) 8.7 (HIGH)

Patch available

May 26, 2026 - 09:01 EUVD

CVE Published

May 26, 2026 - 06:49 nvd

HIGH 8.7

DescriptionCVE.org

The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device.

AnalysisAI

Denial of service in CODESYS Control runtime products and HMI/Toolkit components allows unauthenticated remote attackers to crash affected industrial control systems by sending malformed HTTP requests that trigger a size-limited out-of-bounds write during length parsing. The flaw affects a broad range of CODESYS runtime variants used across PLCs, industrial PCs, and embedded controllers from vendors like Beckhoff, WAGO, and Raspberry Pi-based deployments. No public exploit identified at time of analysis, EPSS is low (0.07%), but the network-reachable, no-privileges-required attack surface makes this operationally significant for OT environments.

Technical ContextAI

The vulnerability resides in CODESYS runtime components (Control RTE, Control Win, HMI, Runtime Toolkit, and the Control for X SL family) which expose an HTTP interface for engineering and management. CWE-1284 (Improper Validation of Specified Quantity in Input) describes the root cause: the HTTP request parser fails to correctly validate length fields before writing to a fixed buffer, producing a bounded out-of-bounds write. Because the write is size-limited (not attacker-controlled large), the practical effect is memory corruption that crashes the runtime process rather than enabling code execution. CODESYS runtimes are deployed on Linux ARM/x86, Windows, and bare-metal RTE configurations across PLCs and industrial gateways, making the affected codebase widespread in OT/ICS networks.

RemediationAI

Upgrade to CODESYS Control RTE/Win/HMI/Runtime Toolkit version 3.5.22.20 or later for the 3.5.x branch, and to version 4.21.0.0 or later for all Control for X SL products and Virtual Control SL. The vendor-released patch is referenced in CERT@VDE advisory VDE-2026-057 (https://www.certvde.com/en/advisories/VDE-2026-057/). Where patching cannot be performed immediately on production controllers, restrict network reachability of the CODESYS runtime HTTP/management ports to engineering workstations only via firewall ACLs or VLAN segmentation - this is effective because the attack vector is network-only and unauthenticated, but it will break any legitimate remote engineering access until allowlists are configured. Disabling the HTTP-accessible runtime interface where the deployment does not require it is another option, with the trade-off that web-based HMI and remote programming via CODESYS tooling will be unavailable. Monitoring for unexpected runtime restarts can serve as a detection signal.