CVE-2025-41739

mediumPriorität · verfolgen · 0EPSS 0.003 · 27. PerzentilDEEURU
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.35% (27th) EPSS
CVSS 5.9 · medium
Is it mine?
73 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-22

An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a denial of service.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobencodesys_psirt

    Update the following products to version 3.5.21.40. * CODESYS PLCHandler * CODESYS Remote Target Visu * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

  • Behobenwago_psirt

    Update to Firmware version 4.10.0 (FW32) or higher. For the latest Custom Firmware please contact the WAGO support.

  • BehobenCOMBIVIS Control Runtimekeb_psirt

    Update the COMBIVIS Control Runtime service to version 2.1.0.

  • Mitigationcodesys_psirt

    As the flaw resides in the SysSocketSelect() implementation, which has been switched to a poll()-based approach by default since version 3.5.21.0, the following setting can be added to the configuration file of the affected product (e.g., CODESYSControl.cfg) to revert to the select()-based implementation: [SysSocket] LinuxSelectPoll=1 Note: On Linux select() is limited to less than 1024 file descriptors.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.9
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.15.9mediumAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · info@cert.vde.comAusnutzbarkeit 2.2 · Auswirkung 3.6
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · WAGO PSIRT DE
v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CODESYS PSIRT
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · KEB PSIRT
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-125USCWE-125USCWE-125USCWE-125USCWE-125US
05

betroffene Produkte (73)

Betroffene Produkte und Versionsbereiche.

20 von 73 angezeigt
06

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

  • Advisory2025-09_VDE-2025-099CODESYS Control - Linux/QNX SysSocket flaw2025-12-01csaf · codesys_psirtDE

    A vulnerability has been identified in the CODESYS Control runtime system, which includes an abstraction layer designed to ensure compatibility across different operating systems. This layer is used both by affected CODESYS products and by applications running on the PLC. The platform-specific adaptation of this abstraction layer for Linux and QNX contains a flaw in the SysSocket implementation. Due to incorrect internal handling and depending on how the caller interacts with the affected function, the issue can lead to an out-of-bounds read. An unauthenticated attacker may be able to exploit this vulnerability via socket-based communication, potentially causing a crash of the corresponding communication task. Additionally, also clients such as the PLCHandler running on Linux or QNX may be affected if they connect to a malicious server that triggers the flaw. Successful exploitation requires the attacker to win a race condition, which increases the complexity of the attack. Note: All platforms other than Linux and QNX are not affected.

  • VDE-2025-081WAGO: Multiple PLCs and Communication Components are Affected by multiple Vulnerabilities leading to RCE2026-10-01csaf · wago_psirtDE

    Multiple WAGO devices are affected by CODESYS Control vulnerabilities. The affected WAGO firmware versions are <4.10.0 (FW32) and <4.10.0 (70).

  • VDE-2026-105KEB Automation: Multiple Vulnerabilities in COMBIVIS Control Runtime2026-10-08csaf · keb_psirtDE

    The Docker-based COMBIVIS Control Runtime service is affected by several vulnerabilities in CODESYS Runtime Toolkit 3.5.21.10. These vulnerabilities are resolved in COMBIVIS Control Runtime 2.1.0.

  • WID-SEC-W-2025-2700CODESYS Control und Development System: Mehrere SchwachstellenDeutsch2025-11-30csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in CODESYS Control und Development System ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen oder einen Denial of Service zu verursachen.

07

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducert_bundcodesys_psirtwago_psirtkeb_psirtNVDCVE.orgMITRE
veröffentlicht 2025-12-01geändert 2026-06-17
09

Referenzen (5)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan