Most recent entries from all

3ADR011377 — AC500 V3 Multiple vulnerabilities

An update is available that resolves a publicly reported vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could call shell functions (CVE-2023-6357), crash the PLC (CVE-2024-5000), crash the web server of the PLC (CVE-2024-8175), grant read access to files (CVE-2024-12429) or enable command execution (CVE-2024-12430). The vulnerabilities CVE-2023-6357, CVE-2024-12429 and CVE-2024-12430 require successful authentication.

EUVD-2026-2802

fkie_cve-2024-5000

An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.

FSA-202601 — Several CODESYS vulnerabilities in Festo Automation Suite

Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently.

This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite.

Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

GHSA-xchm-28cx-p56h

An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.

ICSA-26-076-01 — CODESYS in Festo Automation Suite

Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

VDE-2024-026 — CODESYS: Vulnerability can cause a DoS on CODESYS OPC UA products

An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.

VDE-2025-009 — WAGO: Vulnerabilities in CODESYS Control V3 - OPC UA Stack

Several WAGO Firmwares are vulnerable to an incorrect calculation of the buffer size in the CODESYS OPC UA STACK. This can lead to a crash of the runtime of the affected firmware versions installed on several devices.

WID-SEC-W-2024-1285 — CODESYS: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, Dateien zu manipulieren oder vertrauliche Informationen offenzulegen.