Codesys
105 CVEs across 166 Codesys products. Browse Codesys vulnerabilities, severities, and proof-of-concept exploits.
Codesys products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-35226 | Medium | 6.5 | 2026-07-29 | An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFIN… |
CVE-2026-8047 | High | 7.5 | 2026-05-26 | The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated… |
CVE-2026-8046 | High | 8.1 | 2026-05-26 | The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerabil… |
CVE-2026-44469 | High | 7.8 | 2026-05-26 | The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileg… |
CVE-2026-44468 | High | 7.8 | 2026-05-26 | The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to m… |
CVE-2026-0393 | Medium | 6.5 | 2026-05-21 | The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolatio… |
CVE-2026-35227 | | 2026-05-12 | An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling… | |
CVE-2026-35225 | | 2026-04-23 | An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter stack, preventing legitimate clients fro… | |
CVE-2026-3509 | High | 7.5 | 2026-03-24 | An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, poten… |
CVE-2025-41660 | High | 8.8 | 2026-03-24 | A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution. |
CVE-2026-2364 | High | 7.3 | 2026-03-10 | If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attacker can gain elevat… |
CVE-2025-41739 | Medium | 5.9 | 2025-12-01 | An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux… |
CVE-2025-41738 | High | 7.5 | 2025-12-01 | An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type… |
CVE-2025-41700 | High | 7.8 | 2025-12-01 | An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS deve… |
CVE-2025-41691 | High | 7.5 | 2025-08-04 | An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communic… |
CVE-2025-41659 | High | 8.3 | 2025-08-04 | A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allo… |
CVE-2025-41658 | Medium | 5.5 | 2025-08-04 | CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions. |
CVE-2025-2595 | Medium | 5.3 | 2025-04-23 | An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of… |
CVE-2025-1468 | High | 7.5 | 2025-03-18 | An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-… |
CVE-2025-0694 | Medium | 6.6 | 2025-03-18 | Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access. |
CVE-2024-41975 | Medium | 5.3 | 2025-03-18 | An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs. |
CVE-2024-8175 | High | 7.5 | 2024-09-25 | An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS. |
CVE-2024-6876 | Medium | 4.4 | 2024-09-10 | Out-of-Bounds read vulnerability in OSCAT Basic Library allows an local, unprivileged attacker to access limited internal data of the PLC which may lead to a c… |
CVE-2024-5000 | High | 7.5 | 2024-06-04 | An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorr… |
CVE-2023-5751 | High | 7.8 | 2024-06-04 | A local attacker with low privileges can read and modify any users files and cause a DoS in the working directory of the affected products due to exposure of r… |
CVE-2023-49676 | Medium | 5.5 | 2024-05-06 | An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability. |
CVE-2023-49675 | High | 7.8 | 2024-05-06 | An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write… |
CVE-2023-6357 | High | 8.8 | 2023-12-05 | A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker… |
CVE-2022-4046 | High | 8.8 | 2023-08-03 | In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges… |
CVE-2023-3669 | Low | 3.3 | 2023-08-03 | A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password w… |
CVE-2023-37559 | Medium | 6.5 | 2023-08-03 | After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent… |
CVE-2023-37558 | Medium | 6.5 | 2023-08-03 | After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent… |
CVE-2023-37557 | Medium | 6.5 | 2023-08-03 | After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAp… |
CVE-2023-37556 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37555 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37554 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37553 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37552 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37551 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the… |
CVE-2023-37550 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37549 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37548 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37547 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37546 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-3663 | High | 8.8 | 2023-08-03 | In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipula… |
CVE-2023-3662 | High | 7.3 | 2023-08-03 | In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory… |
CVE-2023-37545 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-3670 | High | 7.3 | 2023-07-28 | In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local acce… |
CVE-2022-47393 | Medium | 6.5 | 2023-05-15 | An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multi… |
CVE-2022-47392 | Medium | 6.5 | 2023-05-15 | An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products… |
CVE-2022-4048 | High | 7.7 | 2023-05-15 | Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate… |
CVE-2022-47391 | High | 7.5 | 2023-05-15 | In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addre… |
CVE-2022-47390 | High | 8.8 | 2023-05-15 | An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple… |
CVE-2022-47389 | High | 8.8 | 2023-05-15 | An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple… |
CVE-2022-47388 | High | 8.8 | 2023-05-15 | An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple… |
CVE-2022-47387 | High | 8.8 | 2023-05-15 | An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple… |
CVE-2022-47386 | High | 8.8 | 2023-05-15 | An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple… |
CVE-2022-47385 | High | 8.8 | 2023-05-15 | An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple… |
CVE-2022-47384 | High | 8.8 | 2023-05-15 | An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple… |
CVE-2022-47383 | High | 8.8 | 2023-05-15 | An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple… |
CVE-2022-47382 | High | 8.8 | 2023-05-15 | An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple… |
CVE-2022-47381 | High | 8.8 | 2023-05-15 | An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into t… |
CVE-2022-47380 | High | 8.8 | 2023-05-15 | An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into… |
CVE-2022-47379 | High | 8.8 | 2023-05-15 | An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which… |
CVE-2022-47378 | Medium | 6.5 | 2023-05-15 | Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requ… |
CVE-2022-22508 | Medium | 4.3 | 2023-05-15 | Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type. |
CVE-2022-4224 | High | 8.8 | 2023-03-23 | In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS re… |
CVE-2018-25048 | High | 8.8 | 2023-03-23 | The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system… |
CVE-2020-12069 | High | 7.8 | 2022-12-26 | In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords… |
CVE-2022-1989 | Medium | 5.3 | 2022-08-23 | All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to en… |
CVE-2022-30792 | High | 7.5 | 2022-07-11 | In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel… |
CVE-2022-30791 | High | 7.5 | 2022-07-11 | In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing… |
CVE-2022-1794 | Medium | 5.5 | 2022-07-11 | The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windo… |
CVE-2022-32143 | High | 8.8 | 2022-06-24 | In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All re… |
CVE-2022-32142 | High | 8.1 | 2022-06-24 | Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which ca… |
CVE-2022-32141 | Medium | 6.5 | 2022-06-24 | Multiple CODESYS Products are prone to a buffer over read. A low privileged remote attacker may craft a request with an invalid offset, which can cause an inte… |
CVE-2022-32140 | Medium | 6.5 | 2022-06-24 | Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checkin… |
CVE-2022-32139 | Medium | 6.5 | 2022-06-24 | In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service conditi… |
CVE-2022-32138 | High | 8.8 | 2022-06-24 | In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or… |
CVE-2022-32137 | High | 8.8 | 2022-06-24 | In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-serv… |
CVE-2022-32136 | Medium | 6.5 | 2022-06-24 | In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-… |
CVE-2022-31806 | Critical | 9.8 | 2022-06-24 | In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or promp… |
CVE-2022-31805 | High | 7.5 | 2022-06-24 | In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected. |
CVE-2022-31804 | High | 7.5 | 2022-06-24 | The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. An unauthenticated attacker may allocate an arbitrary amou… |
CVE-2022-31803 | Medium | 5.3 | 2022-06-24 | In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP c… |
CVE-2022-31802 | Critical | 9.8 | 2022-06-24 | In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. A… |
CVE-2022-1965 | High | 8.1 | 2022-06-24 | Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the e… |
CVE-2022-22519 | High | 7.5 | 2022-04-07 | A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the C… |
CVE-2022-22518 | Medium | 6.5 | 2022-04-07 | A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to components part of the appl… |
CVE-2022-22517 | High | 7.5 | 2022-04-07 | An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets… |
CVE-2022-22516 | High | 7.8 | 2022-04-07 | The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space. |
CVE-2022-22515 | High | 8.1 | 2022-04-07 | A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify t… |
CVE-2022-22514 | High | 7.1 | 2022-04-07 | An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of… |
CVE-2022-22513 | Medium | 6.5 | 2022-04-07 | An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash. |
CVE-2022-22510 | High | 7.5 | 2022-02-02 | Codesys Profinet in version V4.2.0.0 is prone to null pointer dereference that allows a denial of service (DoS) attack of an unauthenticated user via SNMP. |
CVE-2021-34599 | High | 7.4 | 2021-12-01 | Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate vali… |
CVE-2021-34596 | Medium | 6.5 | 2021-10-26 | A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resul… |
CVE-2021-34595 | High | 8.1 | 2021-10-26 | A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions… |
CVE-2021-34593 | High | 7.5 | 2021-10-26 | In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-ser… |
CVE-2021-34586 | High | 7.5 | 2021-10-26 | In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a… |