Codesys vulnerabilities
156 vulnerabilities
Known vulnerabilities in Codesys products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 139 products.
Products
50 of 139- Control For Iot2000 Sl55 vulnerabilities
- Control For Linux Sl55 vulnerabilities
- Control For Pfc100 Sl55 vulnerabilities
- Control For Pfc200 Sl55 vulnerabilities
- Control For Raspberry Pi Sl54 vulnerabilities
- Control For Beaglebone Sl53 vulnerabilities
- Control For Empc A\/Imx6 Sl52 vulnerabilities
- Control Runtime System Toolkit51 vulnerabilities
- Codesys Control For Beaglebone SL50 vulnerabilities
- Codesys Control For Empc A/Imx6 SL50 vulnerabilities
- Codesys Control For Iot2000 SL50 vulnerabilities
- Codesys Control For Linux SL50 vulnerabilities
- Codesys Control For Pfc100 SL50 vulnerabilities
- Codesys Control For Pfc200 SL50 vulnerabilities
- Codesys Control For Raspberry Pi SL50 vulnerabilities
- Codesys Control For WAGO Touch Panels 600 SL50 vulnerabilities
- Codesys Control For Plcnext SL49 vulnerabilities
- Codesys Control Win (SL)49 vulnerabilities
- Control Rte Sl49 vulnerabilities
- Control Win Sl49 vulnerabilities
- Codesys Control RTE (For Beckhoff CX) SL48 vulnerabilities
- Codesys Control RTE (SL)48 vulnerabilities
- Codesys HMI (SL)47 vulnerabilities
- Control For Wago Touch Panels 600 Sl46 vulnerabilities
- Control For Plcnext Sl45 vulnerabilities
- Development System43 vulnerabilities
- Codesys Control Runtime System Toolkit40 vulnerabilities
- Codesys Development System V340 vulnerabilities
- Hmi Sl33 vulnerabilities
- Codesys Safety SIL2 Runtime Toolkit31 vulnerabilities
- Hmi30 vulnerabilities
- Control Rte Sl \(For Beckhoff Cx\)27 vulnerabilities
- Runtime Toolkit27 vulnerabilities
- Control Rte \(For Beckhoff Cx\) Sl21 vulnerabilities
- Safety Sil221 vulnerabilities
- Development System V320 vulnerabilities
- Gateway19 vulnerabilities
- Plcwinnt17 vulnerabilities
- Safety Sil2 Psp17 vulnerabilities
- Safety Sil2 Runtime Toolkit17 vulnerabilities
- Codesys Safety SIL2 PSP16 vulnerabilities
- Embedded Target Visu Toolkit16 vulnerabilities
- Remote Target Visu Toolkit16 vulnerabilities
- Control For Empc A\/Imx615 vulnerabilities
- Control For Beaglebone14 vulnerabilities
- Control Rte14 vulnerabilities
- Control Win14 vulnerabilities
- Codesys13 vulnerabilities
- Control For Iot200012 vulnerabilities
- Control For Pfc10012 vulnerabilities
CVE-2018-20025codesyscontrol_for_beaglebone_sl+15
EPSS score2.56%
Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.CVE-2018-20026codesyscontrol_for_beaglebone_sl+18EPSS score3.04%
Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0.CVE-2018-25048codesyscontrol_for_beaglebone+23EPSS score1.02%
The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.CVE-2018-106123s-smart3s-smart software solutions gmbh codesys control v3 products prior to version 3.5.14.0+12EPSS score1.26%
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.CVE-2021-21869codesyscodesysEPSS score1.89%
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.CVE-2021-21863codesysdevelopment_systemEPSS score1.21%
A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.CVE-2021-21865codesysdevelopment_systemEPSS score1.40%
A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System 3.5.16. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.CVE-2021-21864codesysdevelopment_systemEPSS score1.86%
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.CVE-2021-21868codesyscodesysEPSS score1.73%
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.CVE-2021-21867codesyscodesysEPSS score1.78%
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.CVE-2021-21866codesysdevelopment_systemEPSS score1.80%
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.CVE-2021-36765codesysethernetipEPSS score0.99%
In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system.CVE-2021-36764codesysgatewayEPSS score0.99%
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affected CODESYS products and may result in a denial-of-service condition.CVE-2021-36763codesyscontrol+6EPSS score1.01%
In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.CVE-2021-29242codesyscontrol_for_beaglebone_sl+21EPSS score1.07%
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.CVE-2021-29241codesyscontrol_for_beaglebone_sl+10EPSS score1.43%
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).CVE-2021-29238codesysautomation_serverEPSS score0.53%
CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF).CVE-2021-29240codesysdevelopment_systemEPSS score0.94%
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODESYS packages with malicious content.CVE-2021-29239codesysdevelopment_systemEPSS score0.18%
CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity.CVE-2021-30190codesysv2_web_server+27EPSS score1.39%
CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.