7.8Yüksek
CVE-2026-44469Incorrect Default Permissions in CODESYS Development System
Açıklama
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation.
Zayıflık türü (CWE):
CWE-276
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| CODESYS | CODESYS Development System | 3.0.0.0 – < 3.5.22.20 | |
| codesys | development system | < 3.5.22.20 |
Kaynaklar ve yamalar
- https://www.certvde.com/en/advisories/VDE-2026-055/ Third Party Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*< 3.5.22.20