7.8Hoch
CVE-2025-41700CODESYS Development System - Deserialization of Untrusted Data
Beschreibung
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.
Schwachstellentyp (CWE):
CWE-502
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| codesys | codesys | < 3.5.21.40 | |
| CODESYS | CODESYS Development System | 0.0.0 – < 3.5.21.40 |
Referenzen und Patches
- https://certvde.com/de/advisories/VDE-2025-101 Third Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:codesys:codesys:*:*:*:*:*:*:*:*< 3.5.21.40