CODESYS Control EUVD-2026-31800

The affected CODESYS runtime's HTTP management/communication interface must be reachable from the attacker's network position - typically TCP port exposure on the controller or industrial PC running CODESYS Control RTE/Win, HMI, Runtime Toolkit, or any Control for X SL variant in the listed version ranges. No authentication, no user interaction, and no special configuration are required (PR:N/UI:N/AT:N): default-installed runtimes in the vulnerable version range are exploitable as deployed. Limiting factors: the runtime port is often (but not always) confined to an OT/engineering VLAN, so exploitation requires the attacker to be on that segment or to traverse from IT through a misconfigured boundary; impact is restricted to availability (process crash) and does not yield code execution or data disclosure.

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and zero confidentiality/integrity impact aligns with a pure availability denial of service - consistent with the description's crash outcome. EPSS at 0.07% (22nd percentile) and SSVC Exploitation:none indicate no observed in-the-wild activity, but SSVC Automatable:yes and Technical Impact:partial reflect that a network-reachable crash primitive is trivially scriptable once a PoC emerges. The 8.7 CVSS is driven entirely by reachability and lack of preconditions, not by impact severity; this is a high-priority issue specifically for OT operators because crashing a PLC runtime can halt physical processes, but it is not a code-execution or data-theft risk. No conflicting signals between CVSS and description.

An attacker on the OT network (or one who has pivoted from IT through a flat or poorly segmented network) sends a single crafted HTTP request with a malformed length field to the CODESYS runtime's exposed port, triggering the out-of-bounds write and crashing the runtime process. Because CODESYS runtimes execute control logic for PLCs and industrial gateways, the crash halts the controlled process - potentially stopping a production line, HVAC system, or safety-adjacent function until the runtime is restarted. No public exploit identified at time of analysis, but the low attack complexity makes weaponization straightforward once details circulate.