Most recent entries from all

certfr-2021-avi-370 — De multiples vulnérabilités ont été découvertes dans les produits Schneider. Elles permettent à un attaquant de provoqu…

2026-10-02T09:46:21.333209+00:00

certfr-2021-avi-370

EUVD-2026-52516

2026-10-02T09:46:21.333281+00:00

EUVD-2026-52516

fkie_cve-2019-9009

2026-10-02T09:46:21.333298+00:00

An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.

FSA-202202 — Festo: Controller CECC-S,LK,D family <= 2.3.8.1 - multiple vulnerabilities in CODESYS V3 runtime system

2026-10-02T09:46:21.333327+00:00

The Festo controller CECC product family is affected by multiple vulnerabilities in the CODESYS V3 runtime.

GHSA-5q4m-ggr9-2rqh

2026-10-02T09:46:21.333366+00:00

An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.

gsd-2019-9009

2026-10-02T09:46:21.333381+00:00

gsd-2019-9009

ICSA-19-255-05 — 3S-Smart Software Solutions GmbH CODESYS V3 Products Containing a CODESYS Communication Server

2026-10-02T09:46:21.333391+00:00

A crafted request may cause an unhandled error in the affected CODESYS products, which results in a denial-of-service condition.CVE-2019-9009 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

VDE-2021-033 — TRUMPF Laser GmbH: multiple products prone to codesys runtime vulnerabilities

2026-10-02T09:46:21.333409+00:00

The TruControl laser control software (versions 1.04 to 3.0.0) uses CODESYS runtime versions affected by multiple CVEs:

**CVE list:**

- CVE-2021-29242 - CVE-2021-29241 - CVE-2019-5105 - CVE-2020-7052 - CVE-2019-9012 - CVE-2019-9010 - CVE-2019-9009 - CVE-2018-10612

In addition to the CVEs listed above, the affected products are also vulnerable to the following issues without a CVE ID:

---

### **CODESYS Advisory 2018-07**

A crafted communication request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition.

- **CVSS v3.0 base score:** 6.5 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12928&token=6d1dcea05a15aeef7ad48eadc64c8eca5d4f07b2&download=)

---

### **CODESYS Advisory 2018-04**

The CODESYS runtime system allows access to files outside the restricted working directory of the controller by online services.

- **CVSS v3.0 base score:** 9.9 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12925&token=50e7240fa947ea215311e3db441f82152f1109b6&download=)

---

### **CODESYS Advisory 2017-03**

A crafted request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition.

- **CVSS v3.0 base score:** 7.5 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:N/…

VDE-2021-054 — Pilz: Multiple vulnerabilities in CODESYS V2 and V3 runtime system

2026-10-02T09:46:21.333463+00:00

Several Pilz products use Versions V2 and V3 of the CODESYS runtime system from CODESYS GmbH, which enables the execution of IEC 61131-3 PLC programs. These runtime environments contain several vulnerabilities, which an attacker can exploit via the network. Successful exploitation of the vulnerabilities results in reduced availability and, in a worst case, to the insertion of program code.