Most recent entries from all

3ADR011565 — AC500 V3 - Invalid type usage in visualization

An update is available that resolves publicly reported vulnerability in the products versions listed as affected in the advisory.

An attacker who successfully exploited these vulnerabilities could cause a denial-of-service (DoS).

Advisory2025-10_VDE-2025-100 — CODESYS Control - Invalid type usage in visualization

A vulnerability in the CODESYS Control runtime system's CmpVisuServer component allows attackers to cause a denial-of-service (DoS) by sending special request to the CODESYS Web- or remote Target Visu. The issue is triggered by an internal read access using a pointer of wrong type.

Only CODESYS Control runtime systems and PLCs based on the CODESYS Runtime Toolkit that include the CmpVisuServer component are impacted.

In the case of CODESYS Web Visu, the vulnerability can only be exploited if the web server is running. When the web server starts depends on the startup configuration: By default, it is only running if the PLC executes application code that includes a visualization.

bdu:2025-16471

EUVD-2026-262065

fkie_cve-2025-41738

An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.

GHSA-7pvj-rp26-vxxc

VDE-2025-081 — WAGO: Multiple PLCs and Communication Components are Affected by multiple Vulnerabilities leading to RCE

Multiple WAGO devices are affected by CODESYS Control vulnerabilities. The affected WAGO firmware versions are <4.10.0 (FW32) and <4.10.0 (70).

WID-SEC-W-2025-2700 — CODESYS Control und Development System: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in CODESYS Control und Development System ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen oder einen Denial of Service zu verursachen.