CODESYS Development System vulnerabilities
7 known vulnerabilities in CODESYS Development System from Codesys. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.0 High severity
CODESYS Development System: Incorrect Default Permissions
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verifie
- 7.8 High severity
CODESYS Development System: Incorrect Default Permissions
The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation b
- 7.8 High severity
CODESYS Development System: Deserialization of Untrusted Data
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.
- 8.8 High severity
CODESYS Development System: Improper Verification of Source of a Communication Channel
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
- 7.3 High severity
CODESYS Development System: Uncontrolled Search Path Element
In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context .
- 7.3 High severity
CODESYS Development System: Exposure of Resource to Wrong Sphere
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by le
- 7.5 High severity
CODESYS Development System: Unprotected Transport of Credentials
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.