Vulnerability-Lookup

CVE-2025-41659 (GCVE-0-2025-41659)

Vulnerability from cvelistv5 – Published: 2025-08-04 08:04 – Updated: 2025-08-04 16:35

Title

CODESYS Control PKI Exposure Enables Remote Certificate Access

Summary

A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-04 16:34 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

CERTVDE icscert root

References

1 reference

URL	Tags
https://certvde.com/de/advisories/VDE-2025-051

Impacted products

16 products

Vendor	Product	Version	CPE status
CODESYS	Control RTE (SL)	Affected: 0.0.0.0 , < 3.5.21.20 (semver)	guessed
CODESYS	Control RTE (for Beckhoff CX) SL	Affected: 0.0.0.0 , < 3.5.21.20 (semver)	guessed
CODESYS	Control Win (SL)	Affected: 0.0.0.0 , < 3.5.21.20 (semver)	guessed
CODESYS	HMI (SL)	Affected: 0.0.0.0 , < 3.5.21.20 (semver)	guessed
CODESYS	Runtime Toolkit	Affected: 0.0.0.0 , < 3.5.21.20 (semver)	guessed
CODESYS	Control for BeagleBone SL	Affected: 0.0.0.0 , < 4.17.0.0 (semver)	guessed
CODESYS	Control for emPC-A/iMX6 SL	Affected: 0.0.0.0 , < 4.17.0.0 (semver)	guessed
CODESYS	Control for IOT2000 SL	Affected: 0.0.0.0 , < 4.17.0.0 (semver)	guessed
CODESYS	Control for Linux ARM SL	Affected: 0.0.0.0 , < 4.17.0.0 (semver)	guessed
CODESYS	Control for Linux SL	Affected: 0.0.0.0 , < 4.17.0.0 (semver)	guessed
CODESYS	Control for PFC100 SL	Affected: 0.0.0.0 , < 4.17.0.0 (semver)	guessed
CODESYS	Control for PFC200 SL	Affected: 0.0.0.0 , < 4.17.0.0 (semver)	guessed
CODESYS	Control for PLCnext SL	Affected: 0.0.0.0 , < 4.17.0.0 (semver)	guessed
CODESYS	Control for Raspberry Pi SL	Affected: 0.0.0.0 , < 4.17.0.0 (semver)	guessed
CODESYS	Control for WAGO Touch Panels 600 SL	Affected: 0.0.0.0 , < 4.17.0.0 (semver)	guessed
CODESYS	Virtual Control SL	Affected: 0.0.0.0 , < 4.17.0.0 (semver)	guessed

Credits

Luca Borzacchiello from Nozomi Networks

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-04T16:34:47.316036Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-04T16:35:32.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Control RTE (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.20",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control RTE (for Beckhoff CX) SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.20",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control Win (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.20",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "HMI (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.20",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Runtime Toolkit",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.20",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for BeagleBone SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for emPC-A/iMX6 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for IOT2000 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for Linux ARM SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for Linux SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for PFC100 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for PFC200 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for PLCnext SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for Raspberry Pi SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for WAGO Touch Panels 600 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Virtual Control SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Luca Borzacchiello from Nozomi Networks"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.\u003cbr\u003e"
            }
          ],
          "value": "A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-04T08:04:04.597Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://certvde.com/de/advisories/VDE-2025-051"
        }
      ],
      "source": {
        "advisory": "VDE-2025-051",
        "defect": [
          "CERT@VDE#641801"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "CODESYS Control PKI Exposure Enables Remote Certificate Access",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2025-41659",
    "datePublished": "2025-08-04T08:04:04.597Z",
    "dateReserved": "2025-04-16T11:17:48.307Z",
    "dateUpdated": "2025-08-04T16:35:32.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-41659",
      "date": "2026-09-15",
      "epss": "0.00222",
      "percentile": "0.12929"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-41659\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2025-08-04T08:15:48.173\",\"lastModified\":\"2026-06-17T09:22:54.780\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.\"},{\"lang\":\"es\",\"value\":\"Un atacante con pocos privilegios puede acceder remotamente a la carpeta PKI del sistema de ejecuci\u00f3n de CODESYS Control y, por lo tanto, leer y escribir certificados y sus claves. Esto permite extraer datos confidenciales o aceptar certificados como de confianza. Aunque todos los servicios permanecen disponibles, solo es posible la comunicaci\u00f3n sin cifrar si se eliminan los certificados.\"}],\"affected\":[{\"source\":\"info@cert.vde.com\",\"affectedData\":[{\"vendor\":\"CODESYS\",\"product\":\"Control RTE (SL)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"3.5.21.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control RTE (for Beckhoff CX) SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"3.5.21.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control Win (SL)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"3.5.21.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"HMI (SL)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"3.5.21.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Runtime Toolkit\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"3.5.21.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for BeagleBone SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"4.17.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for emPC-A/iMX6 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"4.17.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for IOT2000 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"4.17.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for Linux ARM SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"4.17.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for Linux SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"4.17.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for PFC100 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"4.17.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for PFC200 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"4.17.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for PLCnext SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"4.17.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for Raspberry Pi SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"4.17.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for WAGO Touch Panels 600 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"4.17.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Virtual Control SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0.0\",\"lessThan\":\"4.17.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":8.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":5.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-08-04T16:34:47.316036Z\",\"id\":\"CVE-2025-41659\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"references\":[{\"url\":\"https://certvde.com/de/advisories/VDE-2025-051\",\"source\":\"info@cert.vde.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-08-06T08:29:02+00:00",
      "cve": "CVE-2025-41659",
      "id": "CVE-2025-41659",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CODESYS Control PKI Exposure Enables Remote Certificate Access",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-41659.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-41659\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-04T16:34:47.316036Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-04T16:35:19.558Z\"}}], \"cna\": {\"title\": \"CODESYS Control PKI Exposure Enables Remote Certificate Access\", \"source\": {\"defect\": [\"CERT@VDE#641801\"], \"advisory\": \"VDE-2025-051\", \"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Luca Borzacchiello from Nozomi Networks\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"CODESYS\", \"product\": \"Control RTE (SL)\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"3.5.21.20\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control RTE (for Beckhoff CX) SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"3.5.21.20\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control Win (SL)\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"3.5.21.20\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"HMI (SL)\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"3.5.21.20\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Runtime Toolkit\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"3.5.21.20\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control for BeagleBone SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"4.17.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control for emPC-A/iMX6 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"4.17.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control for IOT2000 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"4.17.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control for Linux ARM SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"4.17.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control for Linux SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"4.17.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control for PFC100 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"4.17.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control for PFC200 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"4.17.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control for PLCnext SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"4.17.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control for Raspberry Pi SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"4.17.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Control for WAGO Touch Panels 600 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"4.17.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"Virtual Control SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0.0\", \"lessThan\": \"4.17.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://certvde.com/de/advisories/VDE-2025-051\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-732\", \"description\": \"CWE-732 Incorrect Permission Assignment for Critical Resource\"}]}], \"providerMetadata\": {\"orgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"shortName\": \"CERTVDE\", \"dateUpdated\": \"2025-08-04T08:04:04.597Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-41659\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-04T16:35:32.484Z\", \"dateReserved\": \"2025-04-16T11:17:48.307Z\", \"assignerOrgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"datePublished\": \"2025-08-04T08:04:04.597Z\", \"assignerShortName\": \"CERTVDE\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

3ADR011524

Vulnerability from csaf_abb - Published: 2026-02-24 00:30 - Updated: 2026-02-24 00:30

Summary

AC500 V3 Multiple vulnerabilities

Scope

3 vulnerabilities in this advisory, including CVE-2025-41659.

CVE-2025-41659

A vulnerability in the runtime system allows low-privileged remote attackers to access the PKI folder via CODESYS protocol, enabling them to read and write certificates and keys. This exposes sensitive cryptographic data and allows unauthorized certificates to be trusted. However, all services remain available, only certificate based encryption and signing features are concerned. The issue affects systems using the optional CmpOpenSSL component for cryptographic operations.

8.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:F/RL:O/RC:C

Fixed: 1 product Known affected: 1 product

Open the full advisory

ADVISORY2025-07_VDE-2025-051

Vulnerability from csaf_codesysgmbh - Published: 2025-08-04 10:00 - Updated: 2025-09-01 10:00

Summary

CODESYS Control V3 - Exposed PKI folder

Severity

High

Scope

1 vulnerability in this advisory, including CVE-2025-41659.

CVE-2025-41659

8.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Fixed: 16 products Known affected: 16 products

Open the full advisory

BDU:2026-00081

Vulnerability from fstec - Published: 04.08.2025

Title

Уязвимость программных продуктов CODESYS, связанная с неверным назначением разрешений для критического ресурса, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Description

Уязвимость программных продуктов CODESYS связана с неверным назначением разрешений для критического ресурса. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Severity


                    
                      AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Vendor

CODESYS GmbH

Software Name

CODESYS Runtime Toolkit, CODESYS Control for BeagleBone SL, CODESYS Control for emPC-A/iMX6 SL, CODESYS Control for IOT2000 SL, CODESYS Control for Linux ARM SL, CODESYS Control for Linux SL, CODESYS Control for PFC100 SL, CODESYS Control for PFC200 SL, CODESYS Control for PLCnext SL, CODESYS Control for Raspberry Pi SL, CODESYS Control for WAGO Touch Panels 600 SL, CODESYS Control Win (SL), CODESYS Control RTE (SL), CODESYS Control RTE (for Beckhoff CX) SL, CODESYS HMI (SL), CODESYS Virtual Control SL

Software Version

до 3.5.21.20 (CODESYS Runtime Toolkit), до 4.17.0.0 (CODESYS Control for BeagleBone SL), до 4.17.0.0 (CODESYS Control for emPC-A/iMX6 SL), до 4.17.0.0 (CODESYS Control for IOT2000 SL), до 4.17.0.0 (CODESYS Control for Linux ARM SL), до 4.17.0.0 (CODESYS Control for Linux SL), до 4.17.0.0 (CODESYS Control for PFC100 SL), до 4.17.0.0 (CODESYS Control for PFC200 SL), до 4.17.0.0 (CODESYS Control for PLCnext SL), до 4.17.0.0 (CODESYS Control for Raspberry Pi SL), до 4.17.0.0 (CODESYS Control for WAGO Touch Panels 600 SL), до 3.5.21.20 (CODESYS Control Win (SL)), до 3.5.21.20 (CODESYS Control RTE (SL)), до 3.5.21.20 (CODESYS Control RTE (for Beckhoff CX) SL), до 3.5.21.20 (CODESYS HMI (SL)), до 4.17.0.0 (CODESYS Virtual Control SL)

Possible Mitigations

Использование рекомендаций: https://certvde.com/de/advisories/VDE-2025-051/

Reference

https://certvde.com/de/advisories/VDE-2025-051/

CWE

CWE-732

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:C/I:C/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "CODESYS GmbH",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 3.5.21.20 (CODESYS Runtime Toolkit), \u0434\u043e 4.17.0.0 (CODESYS Control for BeagleBone SL), \u0434\u043e 4.17.0.0 (CODESYS Control for emPC-A/iMX6 SL), \u0434\u043e 4.17.0.0 (CODESYS Control for IOT2000 SL), \u0434\u043e 4.17.0.0 (CODESYS Control for Linux ARM SL), \u0434\u043e 4.17.0.0 (CODESYS Control for Linux SL), \u0434\u043e 4.17.0.0 (CODESYS Control for PFC100 SL), \u0434\u043e 4.17.0.0 (CODESYS Control for PFC200 SL), \u0434\u043e 4.17.0.0 (CODESYS Control for PLCnext SL), \u0434\u043e 4.17.0.0 (CODESYS Control for Raspberry Pi SL), \u0434\u043e 4.17.0.0 (CODESYS Control for WAGO Touch Panels 600 SL), \u0434\u043e 3.5.21.20 (CODESYS Control Win (SL)), \u0434\u043e 3.5.21.20 (CODESYS Control RTE (SL)), \u0434\u043e 3.5.21.20 (CODESYS Control RTE (for Beckhoff CX) SL), \u0434\u043e 3.5.21.20 (CODESYS HMI (SL)), \u0434\u043e 4.17.0.0 (CODESYS Virtual Control SL)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://certvde.com/de/advisories/VDE-2025-051/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "04.08.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "06.01.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "06.01.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-00081",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-41659",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "CODESYS Runtime Toolkit, CODESYS Control for BeagleBone SL, CODESYS Control for emPC-A/iMX6 SL, CODESYS Control for IOT2000 SL, CODESYS Control for Linux ARM SL, CODESYS Control for Linux SL, CODESYS Control for PFC100 SL, CODESYS Control for PFC200 SL, CODESYS Control for PLCnext SL, CODESYS Control for Raspberry Pi SL, CODESYS Control for WAGO Touch Panels 600 SL, CODESYS Control Win (SL), CODESYS Control RTE (SL), CODESYS Control RTE (for Beckhoff CX) SL, CODESYS HMI (SL), CODESYS Virtual Control SL",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 CODESYS, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u0438\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 (CWE-732)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 CODESYS \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://certvde.com/de/advisories/VDE-2025-051/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0410\u0421\u0423 \u0422\u041f, \u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0410\u0421\u0423 \u0422\u041f, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0410\u0421\u0423 \u0422\u041f",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-732",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,7)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,3)"
}

FKIE_CVE-2025-41659

Vulnerability from fkie_nvd - Published: 2025-08-04 08:15 - Updated: 2026-06-17 09:22

Severity

8.3 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Summary

References

	URL	Tags
	info@cert.vde.com	https://certvde.com/de/advisories/VDE-2025-051

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Control RTE (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.20",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control RTE (for Beckhoff CX) SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.20",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control Win (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.20",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "HMI (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.20",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Runtime Toolkit",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.21.20",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for BeagleBone SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for emPC-A/iMX6 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for IOT2000 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for Linux ARM SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for Linux SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for PFC100 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for PFC200 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for PLCnext SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for Raspberry Pi SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for WAGO Touch Panels 600 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Virtual Control SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.17.0.0",
              "status": "affected",
              "version": "0.0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "info@cert.vde.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted."
    },
    {
      "lang": "es",
      "value": "Un atacante con pocos privilegios puede acceder remotamente a la carpeta PKI del sistema de ejecuci\u00f3n de CODESYS Control y, por lo tanto, leer y escribir certificados y sus claves. Esto permite extraer datos confidenciales o aceptar certificados como de confianza. Aunque todos los servicios permanecen disponibles, solo es posible la comunicaci\u00f3n sin cifrar si se eliminan los certificados."
    }
  ],
  "id": "CVE-2025-41659",
  "lastModified": "2026-06-17T09:22:54.780",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.5,
        "source": "info@cert.vde.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-41659",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-08-04T16:34:47.316036Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-08-04T08:15:48.173",
  "references": [
    {
      "source": "info@cert.vde.com",
      "url": "https://certvde.com/de/advisories/VDE-2025-051"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ],
      "source": "info@cert.vde.com",
      "type": "Secondary"
    }
  ]
}

FSA-202601

Vulnerability from csaf_festosecokg - Published: 2026-02-26 08:00 - Updated: 2026-02-26 08:00

Summary

Several CODESYS vulnerabilities in Festo Automation Suite

Severity

Critical

Scope

126 vulnerabilities in this advisory, including CVE-2025-41659.

CVE-2025-41659

8.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Fixed: 1 product Known affected: 4 products

Open the full advisory

GHSA-X97Q-FJXX-PVXM

Vulnerability from github – Published: 2025-08-04 09:30 – Updated: 2025-08-04 09:30

Details

Severity

8.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-41659"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-04T08:15:48Z",
    "severity": "HIGH"
  },
  "details": "A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.",
  "id": "GHSA-x97q-fjxx-pvxm",
  "modified": "2025-08-04T09:30:28Z",
  "published": "2025-08-04T09:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41659"
    },
    {
      "type": "WEB",
      "url": "https://certvde.com/de/advisories/VDE-2025-051"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

ICSA-26-076-01

Vulnerability from csaf_cisa - Published: 2026-02-26 08:00 - Updated: 2026-03-17 06:00

Summary

CODESYS in Festo Automation Suite

Severity

Critical

Scope

126 vulnerabilities in this advisory, including CVE-2025-41659.

CVE-2025-41659

8.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Fixed: 1 product Known affected: 4 products

Open the full advisory

ICSA-26-132-03

Vulnerability from csaf_cisa - Published: 2026-02-24 00:30 - Updated: 2026-05-12 05:00

Summary

ABB AC500 V3 Multiple Vulnerabilities

Scope

3 vulnerabilities in this advisory, including CVE-2025-41659.

CVE-2025-41659

8.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:F/RL:O/RC:C

Fixed: 1 product Known affected: 1 product

Open the full advisory

VDE-2026-005

Vulnerability from csaf_ifmelectronicgmbh - Published: 2026-05-06 08:00 - Updated: 2026-05-06 08:00

Summary

ifm: Multiple Vulnerabilities in CR3171

Scope

3 vulnerabilities in this advisory, including CVE-2025-41659.

CVE-2025-41659

8.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Fixed: 1 product Known affected: 2 products

https://www.ifm.com/de/en/product/CR3171#documents

Open the full advisory

WID-SEC-W-2025-1705

Vulnerability from csaf_certbund - Published: 2025-08-03 22:00 - Updated: 2025-08-04 22:00

Summary

CODESYS: Mehrere Schwachstellen

Severity

Hoch

Scope

3 vulnerabilities in this advisory, including CVE-2025-41659.

CVE-2025-41659

Known affected: 3 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-41659 (GCVE-0-2025-41659)

Tags

Sightings

Nomenclature

Related by attack behaviour