CVE-2025-41738

highEPSS 0.004 · 32. PerzentilCHDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.39% (32nd) EPSS
CVSS 7.5 · high
Is it mine?
97 products
Prüfe deine Angriffsfläche
Who says so?
8 sources
cnnvd · enisa_euvd · fstec_bdu · abb_psirt

EPSS · bewertet 2026-10-19

An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxxabb_psirt

    The problem is corrected in the following product version: - AC500 V3 firmware version 3.9.1 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and integrated into Automation Builder 2.9.1. Automation Builder 2.9.1 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download

  • Behobencodesys_psirt

    Update the following products to version 3.5.21.40. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Remote Target Visu * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

  • Behobenwago_psirt

    Update to Firmware version 4.10.0 (FW32) or higher. For the latest Custom Firmware please contact the WAGO support.

  • BehobenCOMBIVIS Control Runtimekeb_psirt

    Update the COMBIVIS Control Runtime service to version 2.1.0.

  • MitigationABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxxabb_psirt

    Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • WorkaroundABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxxabb_psirt

    Disable the web server, if it is enabled, but not required for the PLC operation.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.3
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–8.3

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · info@cert.vde.comAusnutzbarkeit 3.9 · Auswirkung 3.6
v3.18.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondary · WAGO PSIRT DE
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:Csecondary · ABB PSIRT
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CODESYS PSIRT
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · KEB PSIRT
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-843USCWE-843USCWE-843USCWE-843USCWE-843USCWE-843US
05

betroffene Produkte (97)

Betroffene Produkte und Versionsbereiche.

20 von 97 angezeigt
06

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

  • 3ADR011565AC500 V3 - Invalid type usage in visualization2026-09-28csaf · abb_psirtCH

    An update is available that resolves publicly reported vulnerability in the products versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could cause a denial-of-service (DoS).

  • Advisory2025-10_VDE-2025-100CODESYS Control - Invalid type usage in visualization2025-12-01csaf · codesys_psirtDE

    A vulnerability in the CODESYS Control runtime system's CmpVisuServer component allows attackers to cause a denial-of-service (DoS) by sending special request to the CODESYS Web- or remote Target Visu. The issue is triggered by an internal read access using a pointer of wrong type. Only CODESYS Control runtime systems and PLCs based on the CODESYS Runtime Toolkit that include the CmpVisuServer component are impacted. In the case of CODESYS Web Visu, the vulnerability can only be exploited if the web server is running. When the web server starts depends on the startup configuration: By default, it is only running if the PLC executes application code that includes a visualization.

  • VDE-2025-081WAGO: Multiple PLCs and Communication Components are Affected by multiple Vulnerabilities leading to RCE2026-10-01csaf · wago_psirtDE

    Multiple WAGO devices are affected by CODESYS Control vulnerabilities. The affected WAGO firmware versions are <4.10.0 (FW32) and <4.10.0 (70).

  • VDE-2026-105KEB Automation: Multiple Vulnerabilities in COMBIVIS Control Runtime2026-10-08csaf · keb_psirtDE

    The Docker-based COMBIVIS Control Runtime service is affected by several vulnerabilities in CODESYS Runtime Toolkit 3.5.21.10. These vulnerabilities are resolved in COMBIVIS Control Runtime 2.1.0.

  • WID-SEC-W-2025-2700CODESYS Control und Development System: Mehrere SchwachstellenDeutsch2025-11-30csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in CODESYS Control und Development System ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen oder einen Denial of Service zu verursachen.

07

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduabb_psirtcert_bundcodesys_psirtwago_psirtkeb_psirtNVDCVE.orgMITRE
veröffentlicht 2025-12-01geändert 2026-06-17
09

Referenzen (5)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan