Codesys Development System vulnerabilities
8 vulnerabilities
Known vulnerabilities in Codesys Development System, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-41700codesyscodesys+1
EPSS score0.15%
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.CVE-2022-31805codesyscodesys development system+21EPSS score1.02%
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.CVE-2026-44469codesyscodesys development system+1EPSS score0.12%
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation.CVE-2026-44468codesyscodesys development system+1EPSS score0.14%
The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation by forcing the deployment of arbitrary components.CVE-2023-3670codesyscodesys development system+3EPSS score0.20%
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.CVE-2023-3669codesyscodesys development system+1EPSS score0.15%
A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.CVE-2023-3663codesyscodesys development system+1EPSS score1.02%
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.CVE-2023-3662codesyscodesys development system+1EPSS score0.21%
In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context .