7.8Alta
CVE-2025-41700CODESYS Development System - Deserialization of Untrusted Data
Descripción
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.
Debilidad (CWE):
CWE-502
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| codesys | codesys | < 3.5.21.40 | |
| CODESYS | CODESYS Development System | 0.0.0 – < 3.5.21.40 |
Referencias y parches
- https://certvde.com/de/advisories/VDE-2025-101 Third Party Advisory
Coincidencias CPE (NVD) (1)
cpe:2.3:a:codesys:codesys:*:*:*:*:*:*:*:*< 3.5.21.40