EUVD-2026-50166
GHSA-jxhr-7f6w-54g7
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-segment reach (AV:A), no auth or interaction and low complexity for malformed frames (PR:N/UI:N/AC:L), and only a controlled PLC stop means availability-only impact (A:H, C/I:N).
Primary rating from Vendor (CERTVDE).
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
3DescriptionCVE.org
An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime system and results in a controlled stop of the PLC application.
AnalysisAI
Denial-of-service in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same (adjacent) network segment to send malformed PROFINET communication data that triggers an out-of-bounds write and a runtime exception, forcing a controlled stop of the affected PLC application. The impact is availability-only (no data disclosure or code execution is claimed by the vendor); the CVSS 4.0 vector confirms VC:N/VI:N/VA:H. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
CODESYS is a widely embedded IEC 61131-3 runtime deployed across many OEM PLC and industrial-controller product lines; the affected component is its PROFINET Controller stack, which parses PROFINET (a real-time Ethernet-based industrial protocol) frames on the local segment. The root cause is CWE-787 (Out-of-bounds Write): the PROFINET parser fails to correctly validate the size/bounds of incoming communication data, writing outside an intended buffer. Rather than corrupting memory into code execution, the CODESYS Control runtime intercepts the resulting exception and performs a controlled stop of the PLC application - meaning the memory-safety defect manifests as a fail-stop availability event. The single CPE, cpe:2.3:a:codesys:codesys_profinet:*:*:*:*:*:*:*:*, is version-unbounded, indicating no fixed-version boundary was encoded in the provided data.
RemediationAI
Consult CERT@VDE advisory VDE-2026-041 (https://www.certvde.com/en/advisories/VDE-2026-041/) and CODESYS Security Advisories for the fixed release, then upgrade the CODESYS PROFINET Controller / CODESYS Control runtime to the vendor-patched version - no exact fix version was included in the provided data, so do not act on an assumed version number; confirm it from the advisory. Because exploitation requires adjacent-segment access (AV:A), the strongest compensating control until patching is network segmentation: place PROFINET/PLC traffic on a dedicated, isolated OT VLAN or physically separate control network and restrict which hosts can reach the controller's PROFINET interface (trade-off: none for security, but requires accurate asset/flow inventory to avoid breaking legitimate PROFINET peers). Additionally, deploy ICS-aware monitoring/IDS to flag malformed PROFINET frames, and enforce strict switch-port/host allow-listing on the industrial segment; note these controls reduce exposure but do not remove the underlying out-of-bounds write, so patching remains the durable fix.
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. Rated critica
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. Rated
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service con
An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH COD
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODE
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of C
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality o
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality o
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionalit
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before insta
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid reque
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today