EUVD-2026-89729
GHSA-crvr-hhmx-9hp6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable monitoring service exploitable by a low-privileged authenticated client via easy concurrent requests (AC:L, PR:L); race yields data corruption (I:H) and DoS (A:H) with no disclosure (C:N).
Primary rating from Vendor (CERTVDE).
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
3DescriptionCVE.org
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.
AnalysisAI
Concurrent monitoring requests against CODESYS control runtimes are not synchronized, letting an authenticated remote client that already holds monitoring rights corrupt internal memory structures and produce incorrect data processing or a denial-of-service condition. Affected components span the CODESYS soft-PLC family - Control RTE (SL) and Control RTE (for Beckhoff CX) SL, Control Win (SL), Runtime Toolkit, Safety SIL2, HMI (SL), Development System 3, and the Control for Linux, Linux ARM, Raspberry Pi, BeagleBone, PFC100, PFC200, PLCnext, IOT2000, emPC-A/iMX6, WAGO Touch Panels 600 and Virtual Control SL variants. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated remote client that already holds monitoring access to the CODESYS runtime (PR:L), and the attacker must be able to issue multiple concurrent monitoring requests to trigger the race in the unsynchronized access to monitoring functionality. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) reflects a network-reachable race condition (CWE-362) that requires only low privileges - an authenticated user already holding monitoring access - and no user interaction, with high integrity and availability impact but no confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply the CODESYS fixes described in CERT VDE advisory VDE-2026-097 (https://www.certvde.com/en/advisories/VDE-2026-097/) and confirm the exact target versions with the vendor before upgrading, since the published affected ranges terminate at <3.5.22.40 for Development System 3, Safety SIL2, Runtime Toolkit, HMI (SL), Control RTE (SL) and Control RTE (for Beckhoff CX) SL, and at <4.23.0.0 for the Control for Linux, Linux ARM, Raspberry Pi, BeagleBone, PFC100, PFC200, PLCnext, IOT2000, emPC-A/iMX6, WAGO Touch Panels 600 and Virtual Control SL variants - those boundaries indicate the fixed releases but should not be treated as an independent confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment of the affected CODESYS products (Control RTE (SL), Control RTE for Beckhoff CX (SL), Control Win (SL), Runtime Toolkit, Safety SIL2, HMI (SL), Development System 3, and the Control for Linux, Linux ARM, Raspberry Pi, BeagleBone, PFC100, PFC200, PLCnext, IOT2000, emPC-A/iMX6, WAGO Touch Panels 600 and Virtual Control SL variants), confirm the running build against the vendor advisory, and immediately audit and reduce the population of accounts holding monitoring rights - removing shared, contractor, and service accounts that do not strictly require them - while restricting network access to runtime monitoring interfaces to trusted engineering hosts only; note that no public exploit code or confirmed active exploitation has been identified, so this is a hardening and exposure-reduction phase rather than incident response. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. Rated critica
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. Rated
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service con
An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH COD
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODE
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of C
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality o
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality o
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionalit
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before insta
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid reque
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today