Codesys Development_system
44 CVEs affecting Codesys Development_system. Latest disclosed: 2026-05-26. Critical: 1, High: 25.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-9010 | Critical | 9.8 | 2019-08-15 | An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants o… |
CVE-2023-3663 | High | 8.8 | 2023-08-03 | In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipula… |
CVE-2022-4224 | High | 8.8 | 2023-03-23 | In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS re… |
CVE-2019-9013 | High | 8.8 | 2019-08-15 | An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insuffic… |
CVE-2022-22515 | High | 8.1 | 2022-04-07 | A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify t… |
CVE-2026-44469 | High | 7.8 | 2026-05-26 | The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileg… |
CVE-2026-44468 | High | 7.8 | 2026-05-26 | The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to m… |
CVE-2022-22516 | High | 7.8 | 2022-04-07 | The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space. |
CVE-2021-21863 | High | 7.8 | 2021-08-05 | A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5… |
CVE-2021-21866 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development Syst… |
CVE-2021-21865 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System… |
CVE-2021-21864 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development S… |
CVE-2021-29240 | High | 7.8 | 2021-05-04 | The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODE… |
CVE-2021-29239 | High | 7.8 | 2021-05-03 | CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity. |
CVE-2022-30792 | High | 7.5 | 2022-07-11 | In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel… |
CVE-2022-30791 | High | 7.5 | 2022-07-11 | In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing… |
CVE-2022-31805 | High | 7.5 | 2022-06-24 | In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected. |
CVE-2022-22519 | High | 7.5 | 2022-04-07 | A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the C… |
CVE-2022-22517 | High | 7.5 | 2022-04-07 | An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets… |
CVE-2021-29241 | High | 7.5 | 2021-05-03 | CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS). |