CVE-2026-0393
mediumPriorität · verfolgen · 26EPSS 0.002 · 15. PerzentilDEEUUSEPSS · bewertet 2026-10-22
The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolation of authentication data. The vulnerability affects only login operations within an active visualization session.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenCODESYS Visualizationcodesys_psirt
Update the following product to version 4.10.0.0. * CODESYS Visualization For existing affected CODESYS projects that include a visualization, the fix takes effect only after recompiling the application and performing a new download to the HMI or PLC. The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
- MitigationCODESYS Visualizationcodesys_psirt
Two alternative mitigation options have been identified. One option is to avoid using the Input Action "User Management -> Login" for changing users within an active visualization session. Instead, use the Input Action "User Management -> Logout" to do a complete logout followed by a new Login to the Visualization to re-login with another user. Alternatively, property handling within the visualization can be disabled via Project Settings -> Visualization -> General -> Advanced -> "Activate property handling in all element properties", if this is not required for the compilation of the application.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (6)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- Advisory2026-07_VDE-2026-052CODESYS Visualization - Insufficiently Protected Credentials2026-05-21csaf · codesys_psirtDE
A vulnerability in the CODESYS Visualization login dialog has been identified. During logins within the CODESYS Visualization, authentication data may not be sufficiently isolated when multiple users perform login operations concurrently. As a result, an authenticated visualization user may be able to obtain credentials entered by another visualization user. The issue affects only login operations within an active visualization session and can be triggered via local and remote access to the visualization.
- WID-SEC-W-2026-1619CODESYS: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2026-05-20csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in CODESYS ausnutzen, um Informationen offenzulegen.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (4)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2026-0393cnnvd
- https://www.codesys.com/ecosystem/security/latest-codesys-security-advisories/Patchcnnvd
- https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-07_vde-2026-052.jsonenisa_euvd
- https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-07_vde-2026-052.jsonVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan