Codesys vulnerabilities
We track 50 vulnerabilities in Codesys products across 60+ products. 50 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
Latest Codesys vulnerabilities
- 7.5 High severity
CODESYS Control RTE (SL): Uncontrolled Resource Consumption
In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected.
- 7.5 High severity
CODESYS Development System: Unprotected Transport of Credentials
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
- 7.5 High severity
CODESYS Gateway Server V2: Partial String Comparison
In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding p
- 8.1 High severity
Runtime Toolkit: Improper Handling of Exceptional Conditions
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction
- 7.5 High severity
CODESYS Control RTE (SL): Out-of-bounds Read
A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.
- 7.5 High severity
CODESYS Control RTE (SL): Use of Insufficiently Random Values
An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.
- 7.8 High severity
CODESYS Control RTE (SL): Incorrect Permission Assignment for Critical Resource
The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.
- 8.1 High severity
CODESYS Control RTE (SL): Exposure of Resource to Wrong Sphere
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
- 7.1 High severity
CODESYS Control RTE (SL): Improper Restriction of Operations within the Bounds of a Memory Buffer
An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor contr
- 7.5 High severity
Profinet: NULL Pointer Dereference
Codesys Profinet in version V4.2.0.0 is prone to null pointer dereference that allows a denial of service (DoS) attack of an unauthenticated user via SNMP.