CVE-2025-41660

A vendor fix is available.

• Fixedcodesys_psirt

  Update the following products to version 3.5.22.0. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Runtime Toolkit As part of the update, a new configuration file is provided that contains the following setting, which defines the behavior for Service‑group users: [CmpApp] SECURITY.UnsignedApplicationFileTransfer=DENY When this configuration file is used, such as during a new installation, the CODESYS Control runtime system is protected by default. CODESYS Control runtime systems that continue to use an existing configuration will default to the value ALLOW_WITH_WARNING to ensure compatibility. This setting can be changed either through the Device Security Settings dialog in the CODESYS Development System or directly in the configuration file of the CODESYS Control runtime system (CODESYSControl.cfg) by adding the following setting in the section [CmpApp]: SECURITY.UnsignedApplicationFileTransfer= The setting supports the following values: DENY --> Transfer of unsigned applications is blocked (recommended) ALLOW_WITH_WARNING --> Transfer is permitted and a warning is logged (default for existing installations) ALLOW --> Transfer of unsigned applications is permitted (not recommended) The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area [4].

• Mitigationcodesys_psirt

  Without applying the update, the vulnerability can be mitigated by enforcing the use of signed applications through the following setting: [CmpApp] SECURITY.EnforceSignedCode=YES This can be configured either via the Device Security Settings dialog in the CODESYS Development System or directly in the configuration file of the CODESYS Control runtime system (CODESYSControl.cfg). When this option is enabled, the CODESYS Control runtime system loads only trusted and valid signed applications. Alternatively, all users belonging to the Service group can be removed, or the Service group can be deleted entirely. If none of the other mitigation options are feasible, the permissions of the Service group can be restricted by adjusting their access rights. For example, removing modify permissions for the Service group on relevant file system objects can prevent the upload of untrusted boot applications. However, such changes must be applied with caution, as they may lead to inconsistent permissions for this user group and result in unexpected operational limitations. Therefore, this approach should only be considered after a careful assessment of the specific situation.