Most recent entries from all

certfr-2021-avi-370 — De multiples vulnérabilités ont été découvertes dans les produits Schneider. Elles permettent à un attaquant de provoqu…

certfr-2021-avi-370

EUVD-2026-52516

fkie_cve-2019-9009

An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.

FSA-202202 — Festo: Controller CECC-S,LK,D family <= 2.3.8.1 - multiple vulnerabilities in CODESYS V3 runtime system

The Festo controller CECC product family is affected by multiple vulnerabilities in the CODESYS V3 runtime.

GHSA-5q4m-ggr9-2rqh

An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.

gsd-2019-9009

ICSA-19-255-05 — 3S-Smart Software Solutions GmbH CODESYS V3 Products Containing a CODESYS Communication Server

A crafted request may cause an unhandled error in the affected CODESYS products, which results in a denial-of-service condition.CVE-2019-9009 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

VDE-2021-033 — TRUMPF Laser GmbH: multiple products prone to codesys runtime vulnerabilities

The TruControl laser control software (versions 1.04 to 3.0.0) uses CODESYS runtime versions affected by multiple CVEs:

**CVE list:**

- CVE-2021-29242 - CVE-2021-29241 - CVE-2019-5105 - CVE-2020-7052 - CVE-2019-9012 - CVE-2019-9010 - CVE-2019-9009 - CVE-2018-10612

In addition to the CVEs listed above, the affected products are also vulnerable to the following issues without a CVE ID:

---

### **CODESYS Advisory 2018-07**

A crafted communication request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition.

- **CVSS v3.0 base score:** 6.5 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12928&token=6d1dcea05a15aeef7ad48eadc64c8eca5d4f07b2&download=)

---

### **CODESYS Advisory 2018-04**

The CODESYS runtime system allows access to files outside the restricted working directory of the controller by online services.

- **CVSS v3.0 base score:** 9.9 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12925&token=50e7240fa947ea215311e3db441f82152f1109b6&download=)

---

### **CODESYS Advisory 2017-03**

A crafted request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition.

- **CVSS v3.0 base score:** 7.5 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:N/…

VDE-2021-054 — Pilz: Multiple vulnerabilities in CODESYS V2 and V3 runtime system

Several Pilz products use Versions V2 and V3 of the CODESYS runtime system from CODESYS GmbH, which enables the execution of IEC 61131-3 PLC programs. These runtime environments contain several vulnerabilities, which an attacker can exploit via the network. Successful exploitation of the vulnerabilities results in reduced availability and, in a worst case, to the insertion of program code.