CVE-2025-41739
mediumpriority · track · 0EPSS 0.003 · 27 %ileDEEURUEPSS · scored 2026-10-22
An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a denial of service.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedcodesys_psirt
Update the following products to version 3.5.21.40. * CODESYS PLCHandler * CODESYS Remote Target Visu * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
- Fixedwago_psirt
Update to Firmware version 4.10.0 (FW32) or higher. For the latest Custom Firmware please contact the WAGO support.
- FixedCOMBIVIS Control Runtimekeb_psirt
Update the COMBIVIS Control Runtime service to version 2.1.0.
- Mitigationcodesys_psirt
As the flaw resides in the SysSocketSelect() implementation, which has been switched to a poll()-based approach by default since version 3.5.21.0, the following setting can be added to the configuration file of the affected product (e.g., CODESYSControl.cfg) to revert to the select()-based implementation: [SysSocket] LinuxSelectPoll=1 Note: On Linux select() is limited to less than 1024 file descriptors.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (73)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- Advisory2025-09_VDE-2025-099CODESYS Control - Linux/QNX SysSocket flaw2025-12-01csaf · codesys_psirtDE
A vulnerability has been identified in the CODESYS Control runtime system, which includes an abstraction layer designed to ensure compatibility across different operating systems. This layer is used both by affected CODESYS products and by applications running on the PLC. The platform-specific adaptation of this abstraction layer for Linux and QNX contains a flaw in the SysSocket implementation. Due to incorrect internal handling and depending on how the caller interacts with the affected function, the issue can lead to an out-of-bounds read. An unauthenticated attacker may be able to exploit this vulnerability via socket-based communication, potentially causing a crash of the corresponding communication task. Additionally, also clients such as the PLCHandler running on Linux or QNX may be affected if they connect to a malicious server that triggers the flaw. Successful exploitation requires the attacker to win a race condition, which increases the complexity of the attack. Note: All platforms other than Linux and QNX are not affected.
- VDE-2025-081WAGO: Multiple PLCs and Communication Components are Affected by multiple Vulnerabilities leading to RCE2026-10-01csaf · wago_psirtDE
Multiple WAGO devices are affected by CODESYS Control vulnerabilities. The affected WAGO firmware versions are <4.10.0 (FW32) and <4.10.0 (70).
- VDE-2026-105KEB Automation: Multiple Vulnerabilities in COMBIVIS Control Runtime2026-10-08csaf · keb_psirtDE
The Docker-based COMBIVIS Control Runtime service is affected by several vulnerabilities in CODESYS Runtime Toolkit 3.5.21.10. These vulnerabilities are resolved in COMBIVIS Control Runtime 2.1.0.
- WID-SEC-W-2025-2700CODESYS Control und Development System: Mehrere SchwachstellenDeutsch2025-11-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in CODESYS Control und Development System ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen oder einen Denial of Service zu verursachen.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan