CODESYS Control - Out-of-bounds Write
The CmpWebServer component in the CODESYS Control Runtime allows users to create browser-based visualizations for monitoring and controlling industrial processes. Due to improper bounds checking, a specially crafted HTTP request from an unauthenticated remote attacker may lead to a size-limited out-of-bounds write, causing a denial of service of the affected device. The CODESYS Control runtime system is only affected if the web server is active, which by default requires a running application with an enabled Web Visualization.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-8047US | — | — | ||
The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can… | ||||
references
External citations — patches, advisories, analysis.
- Advisory2026-10_VDE-2026-057: CODESYS Control - Out-of-bounds Write - PDFself
- Advisory2026-10_VDE-2026-057: CODESYS Control - Out-of-bounds Write - CSAFself
- Advisory2026-10_VDE-2026-057: CODESYS Control - Out-of-bounds Write - HTMLself
- CERT@VDE Security Advisories for CODESYS GmbHexternal
- CODESYS Security Advisoriesexternal
remediations (1)
- Fixed
Update the following products to version 3.5.22.20. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan