Most recent entries from all

Advisory2025-06_VDE-2025-049 — CODESYS Control V3 - Insecure default permissions

On certain operating systems (e.g., Linux), default file system permissions may allow read access to the files of the CODESYS Control runtime system for non-administrator users. The documentation provided with the CODESYS Runtime Toolkit does not explicitly address this risk. As a result, products based on the toolkit may unintentionally expose sensitive runtime files to local operating system users with limited privileges.

CODESYS Control runtime system based devices are affected if they provide access to the operating system (e.g., via a local user interface or SSH) and user accounts without administrator rights for this access exist or can be created.

bdu:2026-00083

EUVD-2026-248925

fkie_cve-2025-41658

CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.

FSA-202601 — Several CODESYS vulnerabilities in Festo Automation Suite

Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently.

This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite.

Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

GHSA-ff63-c723-v97g

CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.

ICSA-26-076-01 — CODESYS in Festo Automation Suite

Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

VDE-2026-005 — ifm: Multiple Vulnerabilities in CR3171

The Firmware installed on the CR3171 is impacted by various CODESYS vulnerabilities.

WID-SEC-W-2025-1705 — CODESYS: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um einen Denial-of-Service-Zustand auszulösen, Daten zu manipulieren und vertrauliche Informationen preiszugeben.