CVE-2026-79625
highPriorität · verfolgen · 32EPSS 0.002 · 14. PerzentilDEEPSS · bewertet 2026-10-27
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobencodesys_psirt
Update the following products to version 3.5.22.40. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS Runtime Toolkit * CODESYS Safety SIL2 * CODESYS HMI (SL) * CODESYS Development System 3 The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.1–8.1
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (52)
Betroffene Produkte und Versionsbereiche.
- CODESYS Control RTE (SL)alle Versionenfixedcodesys_psirtDEcpe:2.3:a:codesys:codesys_control_rte_sl:3.5.22.40:*:*:*:*:*:*:*
- CODESYS Control RTE (SL)≤ vers:generic/>=3.0.0.0|<3.5.22.40codesys_psirtDEcpe:2.3:a:codesys:codesys_control_rte_sl:*:*:*:*:*:*:*:*
- CODESYS Control RTE (for Beckhoff CX) SLalle Versionenfixedcodesys_psirtDEcpe:2.3:a:codesys:codesys_control_rte_for_beckhoff_cx_sl:3.5.22.40:*:*:*:*:*:*:*
- CODESYS Control RTE (for Beckhoff CX) SL≤ vers:generic/>=3.0.0.0|<3.5.22.40codesys_psirtDEcpe:2.3:a:codesys:codesys_control_rte_for_beckhoff_cx_sl:*:*:*:*:*:*:*:*
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- Advisory2026-12_VDE-2026-097CODESYS Control Runtime - Improper Synchronization in Monitoring2026-09-30csaf · codesys_psirtDE
The monitoring functionality of affected CODESYS Control runtime systems processes read and write requests to PLC application data sent by the CODESYS Development System and other clients such as HMIs. Due to improper synchronization in the CmpMonitor2 component when processing concurrent requests from multiple clients, incorrect data may be read or written, potentially resulting in unexpected behavior of the affected product. PLCs based on the CODESYS Runtime Toolkit or CODESYS Safety SIL2 are affected if they allow simultaneous access by two or more clients via the CODESYS protocol. In CODESYS Development System 3, simultaneous access to the included Simulation Runtime can only occur when access by an external client, such as an HMI, has been explicitly enabled through dedicated configuration. The default configuration of CODESYS Development System 3 is not affected. The vulnerability can be exploited by an authenticated remote attacker with monitoring access by issuing concurrent requests to an affected product.
- WID-SEC-W-2026-3710CODESYS Control Runtime und Gateway Client: Mehrere SchwachstellenDeutsch2026-10-01csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in CODESYS Control Runtime und Gateway Client ausnutzen, um Daten zu manipulieren und einen Denial-of-Service-Zustand herbeizuführen.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (1) nvd
Externe Belege — Patches, Meldungen, Analysen.
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan