Most recent entries from all

3ADR011566 — ABB Automation Builder - Deserialization of untrusted data

ABB is aware of vulnerabilities in the products versions listed as affected in the advisory.

Automation Builder could execute arbitrary code by crafting the project file or project archive file.

Advisory2025-11_VDE-2025-101 — CODESYS Development System - Deserialization of Untrusted Data

A vulnerability has been discovered in the print engine of the CODESYS development system. If a CODESYS project file or archive file was crafted in a specific way, the CODESYS development system could execute arbitrary code when a user opens these files and configures the print/printer options or prints the project or parts of it. This arbitrary code would be executed in the context of the user who was tricked into opening the project.

bdu:2025-15987

EUVD-2026-262064

fkie_cve-2025-41700

An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.

GHSA-cx2q-9f4q-7mgw

VDE-2025-081 — WAGO: Multiple PLCs and Communication Components are Affected by multiple Vulnerabilities leading to RCE

Multiple WAGO devices are affected by CODESYS Control vulnerabilities. The affected WAGO firmware versions are <4.10.0 (FW32) and <4.10.0 (70).

WID-SEC-W-2025-2700 — CODESYS Control und Development System: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in CODESYS Control und Development System ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen oder einen Denial of Service zu verursachen.