Aggregates CVE and security vulnerability intelligence across all CODESYS-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk memory corruption and vendor risk buffer overflow and related problems; some flaws may lead to vendor impact file overwrite, affecting vendor surface production workloads scenarios.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-8047 | The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device. | [email protected] | 8.7 | 0.45% | 2026-05-26 | 2026-06-17 |
| CVE-2026-8046 | The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges. | [email protected] | 7.2 | 0.35% | 2026-05-26 | 2026-06-17 |
| CVE-2026-44469 | The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation. | [email protected] | 8.5 | 0.10% | 2026-05-26 | 2026-06-17 |
| CVE-2026-44468 | The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation by forcing the deployment of arbitrary components. | [email protected] | 8.5 | 0.12% | 2026-05-26 | 2026-06-17 |
| CVE-2026-0393 | The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolation of authentication data. The vulnerability affects only login operations within an active visualization session. | [email protected] | 6.9 | 0.24% | 2026-05-21 | 2026-06-17 |
| CVE-2026-35227 | An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections. | [email protected] | 8.2 | 0.35% | 2026-05-12 | 2026-06-17 |
| CVE-2026-35225 | An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter stack, preventing legitimate clients from establishing new connections. | [email protected] | 8.7 | 0.42% | 2026-04-23 | 2026-06-17 |
| CVE-2025-41738 | An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition. | [email protected] | 7.5 | 0.33% | 2025-12-01 | 2026-06-17 |
| CVE-2025-41700 | An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context. | [email protected] | 7.8 | 0.12% | 2025-12-01 | 2026-06-17 |
| CVE-2024-6876 | Out-of-Bounds read vulnerability in OSCAT Basic Library allows an local, unprivileged attacker to access limited internal data of the PLC which may lead to a crash of the affected service. | [email protected] | 4.4 | 0.16% | 2024-09-10 | 2026-06-17 |
| CVE-2023-6357 | A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device. | [email protected] | 8.8 | 0.96% | 2023-12-05 | 2026-06-17 |
| CVE-2022-4046 | In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device. | [email protected] | 8.8 | 0.66% | 2023-08-03 | 2026-06-17 |
| CVE-2023-3669 | A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog. | [email protected] | 3.3 | 0.14% | 2023-08-03 | 2026-06-17 |
| CVE-2023-37559 | After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37558 | [email protected] | 6.5 | 0.52% | 2023-08-03 | 2026-06-17 |
| CVE-2023-37558 | After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37559 | [email protected] | 6.5 | 0.52% | 2023-08-03 | 2026-06-17 |
| CVE-2023-37557 | After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition. | [email protected] | 6.5 | 0.52% | 2023-08-03 | 2026-06-17 |
| CVE-2023-37556 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37555. | [email protected] | 6.5 | 0.52% | 2023-08-03 | 2026-06-17 |
| CVE-2023-37555 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37556. | [email protected] | 6.5 | 0.52% | 2023-08-03 | 2026-06-17 |
| CVE-2023-37554 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37555 and CVE-2023-37556. | [email protected] | 6.5 | 0.52% | 2023-08-03 | 2026-06-17 |
| CVE-2023-37553 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556. | [email protected] | 6.5 | 0.52% | 2023-08-03 | 2026-06-17 |