CVE-2025-41738
highEPSS 0.004 · 32 %ileCHDEEURUUSEPSS · scored 2026-10-19
An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxxabb_psirt
The problem is corrected in the following product version: - AC500 V3 firmware version 3.9.1 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and integrated into Automation Builder 2.9.1. Automation Builder 2.9.1 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
- Fixedcodesys_psirt
Update the following products to version 3.5.21.40. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Remote Target Visu * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
- Fixedwago_psirt
Update to Firmware version 4.10.0 (FW32) or higher. For the latest Custom Firmware please contact the WAGO support.
- FixedCOMBIVIS Control Runtimekeb_psirt
Update the COMBIVIS Control Runtime service to version 2.1.0.
- MitigationABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxxabb_psirt
Refer to section “General security recommendations” for further advise on how to keep your system secure.
- WorkaroundABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxxabb_psirt
Disable the web server, if it is enabled, but not required for the PLC operation.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–8.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (97)
Products and version ranges known to be affected.
advisories (5)
Vendor and ecosystem advisories describing this.
- 3ADR011565AC500 V3 - Invalid type usage in visualization2026-09-28csaf · abb_psirtCH
An update is available that resolves publicly reported vulnerability in the products versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could cause a denial-of-service (DoS).
- Advisory2025-10_VDE-2025-100CODESYS Control - Invalid type usage in visualization2025-12-01csaf · codesys_psirtDE
A vulnerability in the CODESYS Control runtime system's CmpVisuServer component allows attackers to cause a denial-of-service (DoS) by sending special request to the CODESYS Web- or remote Target Visu. The issue is triggered by an internal read access using a pointer of wrong type. Only CODESYS Control runtime systems and PLCs based on the CODESYS Runtime Toolkit that include the CmpVisuServer component are impacted. In the case of CODESYS Web Visu, the vulnerability can only be exploited if the web server is running. When the web server starts depends on the startup configuration: By default, it is only running if the PLC executes application code that includes a visualization.
- VDE-2025-081WAGO: Multiple PLCs and Communication Components are Affected by multiple Vulnerabilities leading to RCE2026-10-01csaf · wago_psirtDE
Multiple WAGO devices are affected by CODESYS Control vulnerabilities. The affected WAGO firmware versions are <4.10.0 (FW32) and <4.10.0 (70).
- VDE-2026-105KEB Automation: Multiple Vulnerabilities in COMBIVIS Control Runtime2026-10-08csaf · keb_psirtDE
The Docker-based COMBIVIS Control Runtime service is affected by several vulnerabilities in CODESYS Runtime Toolkit 3.5.21.10. These vulnerabilities are resolved in COMBIVIS Control Runtime 2.1.0.
- WID-SEC-W-2025-2700CODESYS Control und Development System: Mehrere SchwachstellenDeutsch2025-11-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in CODESYS Control und Development System ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen oder einen Denial of Service zu verursachen.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan