EUVD-2026-89776
GHSA-cm9r-92x3-hmfj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, availability-only crash triggered by a malicious gateway response with no auth or user interaction required per vendor framing; no confidentiality/integrity impact.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
4DescriptionCVE.org
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity.
AnalysisAI
Memory exhaustion in the CODESYS Gateway Client lets an attacker-controlled gateway crash the client by supplying a crafted response whose size field is trusted without an upper bound, driving uncontrolled resource allocation (CWE-770) and a total loss of availability on the affected client. The vendor scores this 8.7 (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N, driven entirely by VA:H with VC:N/VI:N), and our independent assessment is consistent: remote denial of service with no confidentiality, integrity, or code-execution impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the CODESYS Gateway Client establish a connection to an attacker-controlled or attacker-impersonated gateway; the attacker must be able to serve a crafted gateway response with a maliciously large size field. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores this 8.7 (High), driven entirely by an availability impact (VA:H) with no confidentiality or integrity effect (VC:N/VI:N) - consistent with the CWE-770 uncontrolled-resource-allocation DoS described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis; check the CERT VDE advisory VDE-2026-094 (https://www.certvde.com/en/advisories/VDE-2026-094/) for the current fix status and any patched CODESYS Gateway Client build, and treat that advisory as the authoritative source rather than assuming a fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every host running the CODESYS Gateway Client (engineering laptops, jump servers, and lab machines), record the installed version on each, and notify the OT asset owner; because no vendor-released patch is identified at time of analysis, immediately restrict each client's outbound connections to a short allowlist of known, trusted gateway addresses so it cannot reach an attacker-controlled gateway. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. Rated critica
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. Rated
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service con
An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH COD
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODE
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of C
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality o
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality o
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionalit
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before insta
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid reque
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today