7.8Yüksek
CVE-2025-41700CODESYS Development System - Deserialization of Untrusted Data
Açıklama
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.
Zayıflık türü (CWE):
CWE-502
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| codesys | codesys | < 3.5.21.40 | |
| CODESYS | CODESYS Development System | 0.0.0 – < 3.5.21.40 |
Kaynaklar ve yamalar
- https://certvde.com/de/advisories/VDE-2025-101 Third Party Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:codesys:codesys:*:*:*:*:*:*:*:*< 3.5.21.40