CVE-2025-41691
highpriority · track · 0EPSS 0.005 · 45 %ileCHDEEURUUSEPSS · scored 2026-10-22
An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedAC500 V3abb_psirt
The problem is corrected in the following product versions: - AC500 V3 firmware version 3.9.0 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available from Automation Builder 2.9.0. Automation Builder 2.9.0 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
- Fixedcodesys_psirt
Update the following products to version 3.5.21.20. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
- FixedFirmware 3.1 installed on CR3171ifm_psirt
will be fixed in Firmware Version 3.3
https://www.ifm.com/de/en/product/CR3171#documents - FixedFirmware 3.2 installed on CR3171ifm_psirt
will be fixed in Firmware Version 3.3
https://www.ifm.com/de/en/product/CR3171#documents - FixedCOMBIVIS Control Runtimekeb_psirt
Update the COMBIVIS Control Runtime service to version 2.1.0.
- FixedAC500 V3cisa_csaf_ot
The problem is corrected in the following product versions: - AC500 V3 firmware version 3.9.0 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available from Automation Builder 2.9.0. Automation Builder 2.9.0 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
- MitigationAC500 V3abb_psirt
Refer to section “General security recommendations” for further advise on how to keep your system secure.
- Mitigationcodesys_psirt
The vulnerability can be mitigated by restricting the allowed login authentication type "CmpUserMgr/UserLogin_AuthenticationType" to "ONLY_ASYMMETRIC". This can be configured either via the Device Security Settings dialog in the CODESYS Development System or directly in the configuration file of the CODESYS Control runtime system (CODESYSControl.cfg) by adding the following setting: [CmpUserMgr] SECURITY.UserLogin_AuthenticationType=ONLY_ASYMMETRIC With this configuration in place, both potential attackers and legacy CODESYS protocol clients (prior to version 3.5.16.0) will be blocked from logging in, thereby preventing execution of the vulnerable code path.
- MitigationFirmware 3.1 installed on CR3171ifm_psirt
deactivate CodeSys enviroment on device
- MitigationFirmware 3.2 installed on CR3171ifm_psirt
deactivate CodeSys enviroment on device
- MitigationAC500 V3cisa_csaf_ot
Refer to section “General security recommendations” for further advise on how to keep your system secure.
- WorkaroundAC500 V3abb_psirt
No workarounds are available
- WorkaroundAC500 V3cisa_csaf_ot
No workarounds are available
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (79)
Products and version ranges known to be affected.
advisories (6)
Vendor and ecosystem advisories describing this.
- 3ADR011524AC500 V3 Multiple vulnerabilities2026-02-24csaf · abb_psirtCH
ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. An update is available that resolves these vulnerabilities. An attacker who successfully exploited these vulnerabilities could bypass the user management and read visualization files (CVE-2025-2595), read and write certificates and keys (CVE-2025-41659) or cause a denial-of-service (DoS) (CVE-2025-41691).
- Advisory2025-08_VDE-2025-070CODESYS Control V3 - NULL pointer dereference2025-08-04csaf · codesys_psirtDE
A vulnerability in the CODESYS Control runtime system's CmpDevice component allows unauthenticated attackers to cause a denial-of-service (DoS) via specially crafted communication requests. The issue is triggered by a NULL pointer dereference and also affects systems when outdated CODESYS clients attempt to log in. Only PLCs based on the CODESYS Runtime Toolkit containing the components CmpDevice, CmpAuditLog, and CmpSessionInformation are impacted. **Update 1.1.0, 01.09.2025:** Updated remediation category - fixed SL runtimes are now available.
- VDE-2026-005ifm: Multiple Vulnerabilities in CR31712026-05-06csaf · ifm_psirtDE
The Firmware installed on the CR3171 is impacted by various CODESYS vulnerabilities.
- VDE-2026-105KEB Automation: Multiple Vulnerabilities in COMBIVIS Control Runtime2026-10-08csaf · keb_psirtDE
The Docker-based COMBIVIS Control Runtime service is affected by several vulnerabilities in CODESYS Runtime Toolkit 3.5.21.10. These vulnerabilities are resolved in COMBIVIS Control Runtime 2.1.0.
- WID-SEC-W-2025-1705CODESYS: Mehrere SchwachstellenDeutsch2025-08-03csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um einen Denial-of-Service-Zustand auszulösen, Daten zu manipulieren und vertrauliche Informationen preiszugeben.
- ICSA-26-132-03ABB AC500 V3 Multiple Vulnerabilities2026-02-24icsa · cisa_csaf_otUS
ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. An update is available that resolves these vulnerabilities. An attacker who successfully exploited these vulnerabilities could bypass the user management and read visualization files (CVE-2025-2595), read and write certificates and keys (CVE-2025-41659) or cause a denial-of-service (DoS) (CVE-2025-41691).
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan