7.8High
CVE-2025-41700CODESYS Development System - Deserialization of Untrusted Data
Description
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.
Weakness (CWE):
CWE-502
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| codesys | codesys | < 3.5.21.40 | |
| CODESYS | CODESYS Development System | 0.0.0 – < 3.5.21.40 |
References and patches
- https://certvde.com/de/advisories/VDE-2025-101 Third Party Advisory
CPE matches (NVD) (1)
cpe:2.3:a:codesys:codesys:*:*:*:*:*:*:*:*< 3.5.21.40