{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://www.certvde.com" ] } ], "aggregate_severity": { "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale", "text": "High" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The monitoring functionality of affected CODESYS Control runtime systems processes read and write requests to PLC application data sent by the CODESYS Development System and other clients such as HMIs.\n\nDue to improper synchronization in the CmpMonitor2 component when processing concurrent requests from multiple clients, incorrect data may be read or written, potentially resulting in unexpected behavior of the affected product. \n\nPLCs based on the CODESYS Runtime Toolkit or CODESYS Safety SIL2 are affected if they allow simultaneous access by two or more clients via the CODESYS protocol. In CODESYS Development System 3, simultaneous access to the included Simulation Runtime can only occur when access by an external client, such as an HMI, has been explicitly enabled through dedicated configuration. The default configuration of CODESYS Development System 3 is not affected.\n\nThe vulnerability can be exploited by an authenticated remote attacker with monitoring access by issuing concurrent requests to an affected product.", "title": "Summary" }, { "category": "description", "text": "Successful exploitation may allow an authenticated remote attacker with monitoring access to cause incorrect data processing, malfunction of the affected products, or a denial-of-service condition.", "title": "Impact" }, { "category": "description", "text": "Update the following products to version 3.5.22.40. \n* CODESYS Control RTE (SL)\n* CODESYS Control RTE (for Beckhoff CX) SL\n* CODESYS Control Win (SL)\n* CODESYS Runtime Toolkit\n* CODESYS Safety SIL2\n* CODESYS HMI (SL)\n* CODESYS Development System 3\n\nUpdate the following products to version 4.23.0.0. The release of this version is expected in Q4 2026. \n* CODESYS Control for BeagleBone SL\n* CODESYS Control for emPC-A/iMX6 SL\n* CODESYS Control for IOT2000 SL\n* CODESYS Control for Linux ARM SL\n* CODESYS Control for Linux SL\n* CODESYS Control for PFC100 SL\n* CODESYS Control for PFC200 SL\n* CODESYS Control for PLCnext SL\n* CODESYS Control for Raspberry Pi SL\n* CODESYS Control for WAGO Touch Panels 600 SL\n* CODESYS Virtual Control SL \n\nThe CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.", "title": "Remediation" }, { "category": "general", "text": "As part of a security strategy, CODESYS GmbH strongly recommends at least the following best-practice\ndefense measures:\n\n* Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n* Use firewalls to protect and separate the control system network from other networks\n* Activate and apply user management and password features\n* Limit the access to both development and control system by physical means, operating system features, etc.\n* Use encrypted communication links\n* Use VPN (Virtual Private Networks) tunnels if remote access is required\n* Protect both development and control system by using up to date virus detecting solutions\n\nFor more information and general recommendations for protecting machines and plants, see also the\nCODESYS Security Whitepaper [here.](https://www.customers.codesys.com/fileadmin/data/customers/security/CODESYS-Security-Whitepaper.pdf)", "title": "General Recommendation" }, { "category": "legal_disclaimer", "text": "CODESYS GmbH assumes no liability whatsoever for indirect, collateral, accidental or consequential losses\nthat occur by the distribution and/or use of this document or any losses in connection with the distribution and/or use of this document. All information published in this document is provided on good faith by CODESYS GmbH.\nInsofar as permissible by law, however, none of this information shall establish any guarantee, commitment or\nliability on the part of CODESYS GmbH.\n\nNote: Not all CODESYS features are available in all territories. For more information on geographic restrictions,\nplease contact sales@codesys.com.", "title": "Disclaimer" } ], "publisher": { "category": "vendor", "contact_details": "security@codesys.com", "name": "CODESYS GmbH", "namespace": "https://www.codesys.com" }, "references": [ { "category": "external", "summary": "CERT@VDE Security Advisories for CODESYS GmbH", "url": "https://www.certvde.com/en/advisories/vendor/codesys" }, { "category": "self", "summary": "Advisory2026-12_VDE-2026-097: CODESYS Control Runtime - Improper Synchronization in Monitoring - HTML", "url": "https://www.certvde.com/en/advisories/VDE-2026-097/" }, { "category": "self", "summary": "Advisory2026-12_VDE-2026-097: CODESYS Control Runtime - Improper Synchronization in Monitoring - CSAF", "url": "https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-12_vde-2026-097.json" }, { "category": "external", "summary": "CODESYS Security Advisories", "url": "https://www.codesys.com/security/security-reports.html" }, { "category": "self", "summary": "Advisory2026-12_VDE-2026-097: CODESYS Control Runtime - Improper Synchronization in Monitoring - PDF", "url": "https://api-www.codesys.com/fileadmin/user_upload/CODESYS_Group/Ecosystem/Up-to-Date/Security/Security-Advisories/Advisory2026-12_CDS-94929.pdf" } ], "title": "CODESYS Control Runtime - Improper Synchronization in Monitoring", "tracking": { "aliases": [ "VDE-2026-097", "CODESYS Security Advisory 2026-12" ], "current_release_date": "2026-09-30T10:00:00.000Z", "generator": { "date": "2026-09-24T09:08:54.275Z", "engine": { "name": "Secvisogram", "version": "2.6.12" } }, "id": "Advisory2026-12_VDE-2026-097", "initial_release_date": "2026-09-30T10:00:00.000Z", "revision_history": [ { "date": "2026-09-30T10:00:00.000Z", "number": "1.0.0", "summary": "Initial revision." } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.0.0.0|<3.5.22.40", "product": { "name": "CODESYS Control RTE (SL) 3.0.0.0<3.5.22.40", "product_id": "CSAFPID-51001", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_rte_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "3.5.22.40", "product": { "name": "CODESYS Control RTE (SL) 3.5.22.40", "product_id": "CSAFPID-52001", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_rte_sl:3.5.22.40:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control RTE (SL)" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.0.0.0|<3.5.22.40", "product": { "name": "CODESYS Control RTE (for Beckhoff CX) SL 3.0.0.0<3.5.22.40", "product_id": "CSAFPID-51002", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_rte_for_beckhoff_cx_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "3.5.22.40", "product": { "name": "CODESYS Control RTE (for Beckhoff CX) SL 3.5.22.40", "product_id": "CSAFPID-52002", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_rte_for_beckhoff_cx_sl:3.5.22.40:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control RTE (for Beckhoff CX) SL" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.0.0.0|<3.5.22.40", "product": { "name": "CODESYS Control Win (SL) 3.0.0.0<3.5.22.40", "product_id": "CSAFPID-51003", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_win_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "3.5.22.40", "product": { "name": "CODESYS Control Win (SL) 3.5.22.40", "product_id": "CSAFPID-52003", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_win_sl:3.5.22.40:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control Win (SL)" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.0.0.0|<3.5.22.40", "product": { "name": "CODESYS Runtime Toolkit 3.0.0.0<3.5.22.40", "product_id": "CSAFPID-51004", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_runtime_toolkit:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "3.5.22.40", "product": { "name": "CODESYS Runtime Toolkit 3.5.22.40", "product_id": "CSAFPID-52004", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_runtime_toolkit:3.5.22.40:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Runtime Toolkit" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.0.0.0|<3.5.22.40", "product": { "name": "CODESYS Safety SIL2 3.0.0.0<3.5.22.40", "product_id": "CSAFPID-51005", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_safety_sil2:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "3.5.22.40", "product": { "name": "CODESYS Safety SIL2 3.5.22.40", "product_id": "CSAFPID-52005", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_safety_sil2:3.5.22.40:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Safety SIL2 " }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.0.0.0|<3.5.22.40", "product": { "name": "CODESYS HMI (SL) 3.0.0.0<3.5.22.40", "product_id": "CSAFPID-51006", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_hmi_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "3.5.22.40", "product": { "name": "CODESYS HMI (SL) 3.5.22.40", "product_id": "CSAFPID-52006", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_hmi_sl:3.5.22.40:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS HMI (SL)" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.0.0.0|<3.5.22.40", "product": { "name": "CODESYS Development System 3 3.0.0.0<3.5.22.40", "product_id": "CSAFPID-51007", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_development_system_3:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "3.5.22.40", "product": { "name": "CODESYS Development System 3 3.5.22.40", "product_id": "CSAFPID-52007", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_development_system_3:3.5.22.40:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Development System 3" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.5.0.0|<4.23.0.0", "product": { "name": "CODESYS Control for BeagleBone SL 3.5.0.0<4.23.0.0", "product_id": "CSAFPID-51008", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_beaglebone_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "4.23.0.0", "product": { "name": "CODESYS Control for BeagleBone SL 4.23.0.0", "product_id": "CSAFPID-52008", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_beaglebone_sl:4.23.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control for BeagleBone SL" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.5.0.0|<4.23.0.0", "product": { "name": "CODESYS Control for emPC-A/iMX6 SL 3.5.0.0<4.23.0.0", "product_id": "CSAFPID-51009", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_empc_a_imx6_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "4.23.0.0", "product": { "name": "CODESYS Control for emPC-A/iMX6 SL 4.23.0.0", "product_id": "CSAFPID-52009", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_empc_a_imx6_sl:4.23.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control for emPC-A/iMX6 SL" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.5.0.0|<4.23.0.0", "product": { "name": "CODESYS Control for IOT2000 SL 3.5.0.0<4.23.0.0", "product_id": "CSAFPID-51010", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_iot2000_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "4.23.0.0", "product": { "name": "CODESYS Control for IOT2000 SL 4.23.0.0", "product_id": "CSAFPID-52010", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_iot2000_sl:4.23.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control for IOT2000 SL" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.5.0.0|<4.23.0.0", "product": { "name": "CODESYS Control for Linux ARM SL 3.5.0.0<4.23.0.0", "product_id": "CSAFPID-51011", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_linux_arm_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "4.23.0.0", "product": { "name": "CODESYS Control for Linux ARM SL 4.23.0.0", "product_id": "CSAFPID-52011", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_linux_arm_sl:4.23.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control for Linux ARM SL" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.5.0.0|<4.23.0.0", "product": { "name": "CODESYS Control for Linux SL 3.5.0.0<4.23.0.0", "product_id": "CSAFPID-51012", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_linux_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "4.23.0.0", "product": { "name": "CODESYS Control for Linux SL 4.23.0.0", "product_id": "CSAFPID-52012", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_linux_sl:4.23.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control for Linux SL" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.5.0.0|<4.23.0.0", "product": { "name": "CODESYS Control for PFC100 SL 3.5.0.0<4.23.0.0", "product_id": "CSAFPID-51013", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_pfc100_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "4.23.0.0", "product": { "name": "CODESYS Control for PFC100 SL 4.23.0.0", "product_id": "CSAFPID-52013", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_pfc100_sl:4.23.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control for PFC100 SL" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.5.0.0|<4.23.0.0", "product": { "name": "CODESYS Control for PFC200 SL 3.5.0.0<4.23.0.0", "product_id": "CSAFPID-51014", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_pfc200_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "4.23.0.0", "product": { "name": "CODESYS Control for PFC200 SL 4.23.0.0", "product_id": "CSAFPID-52014", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_pfc200_sl:4.23.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control for PFC200 SL" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.5.0.0|<4.23.0.0", "product": { "name": "CODESYS Control for PLCnext SL 3.5.0.0<4.23.0.0", "product_id": "CSAFPID-51015", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_plcnext_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "4.23.0.0", "product": { "name": "CODESYS Control for PLCnext SL 4.23.0.0", "product_id": "CSAFPID-52015", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_plcnext_sl:4.23.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control for PLCnext SL" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.5.0.0|<4.23.0.0", "product": { "name": "CODESYS Control for Raspberry Pi SL 3.5.0.0<4.23.0.0", "product_id": "CSAFPID-51016", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "4.23.0.0", "product": { "name": "CODESYS Control for Raspberry Pi SL 4.23.0.0", "product_id": "CSAFPID-52016", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_raspberry_pi_sl:4.23.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control for Raspberry Pi SL" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.5.0.0|<4.23.0.0", "product": { "name": "CODESYS Control for WAGO Touch Panels 600 SL 3.5.0.0<4.23.0.0", "product_id": "CSAFPID-51017", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "4.23.0.0", "product": { "name": "CODESYS Control for WAGO Touch Panels 600 SL 4.23.0.0", "product_id": "CSAFPID-52017", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_control_for_wago_touch_panels_600_sl:4.23.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Control for WAGO Touch Panels 600 SL" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=3.5.0.0|<4.23.0.0", "product": { "name": "CODESYS Virtual Control SL 3.5.0.0<4.23.0.0", "product_id": "CSAFPID-51018", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_virtual_control_sl:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "4.23.0.0", "product": { "name": "CODESYS Virtual Control SL 4.23.0.0", "product_id": "CSAFPID-52018", "product_identification_helper": { "cpe": "cpe:2.3:a:codesys:codesys_virtual_control_sl:4.23.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CODESYS Virtual Control SL " } ], "category": "product_family", "name": "Software" } ], "category": "vendor", "name": "CODESYS" } ], "product_groups": [ { "group_id": "CSAFGID-1001", "product_ids": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007" ], "summary": "Affected products v3.5.x." }, { "group_id": "CSAFGID-2001", "product_ids": [ "CSAFPID-52001", "CSAFPID-52002", "CSAFPID-52003", "CSAFPID-52004", "CSAFPID-52005", "CSAFPID-52006", "CSAFPID-52007" ], "summary": "Fixed products v3.5.x." }, { "group_id": "CSAFGID-1002", "product_ids": [ "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51018" ], "summary": "Affected products v4.x." }, { "group_id": "CSAFGID-2002", "product_ids": [ "CSAFPID-52008", "CSAFPID-52009", "CSAFPID-52010", "CSAFPID-52011", "CSAFPID-52012", "CSAFPID-52013", "CSAFPID-52014", "CSAFPID-52015", "CSAFPID-52016", "CSAFPID-52017", "CSAFPID-52018" ], "summary": "Fixed products v4.x." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-79625", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "audience": "all", "category": "description", "text": "Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-52001", "CSAFPID-52002", "CSAFPID-52003", "CSAFPID-52004", "CSAFPID-52005", "CSAFPID-52006", "CSAFPID-52007", "CSAFPID-52008", "CSAFPID-52009", "CSAFPID-52010", "CSAFPID-52011", "CSAFPID-52012", "CSAFPID-52013", "CSAFPID-52014", "CSAFPID-52015", "CSAFPID-52016", "CSAFPID-52017", "CSAFPID-52018" ], "known_affected": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51018" ] }, "references": [ { "category": "external", "summary": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - 7.2 / High", "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "remediations": [ { "category": "vendor_fix", "details": "Update the following products to version 3.5.22.40. \n* CODESYS Control RTE (SL)\n* CODESYS Control RTE (for Beckhoff CX) SL\n* CODESYS Control Win (SL)\n* CODESYS Runtime Toolkit\n* CODESYS Safety SIL2\n* CODESYS HMI (SL)\n* CODESYS Development System 3\n\nThe CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/. ", "group_ids": [ "CSAFGID-1001" ] }, { "category": "none_available", "details": "Update the following products to version 4.23.0.0. The release of this version is expected in Q4 2026. \n* CODESYS Control for BeagleBone SL\n* CODESYS Control for emPC-A/iMX6 SL\n* CODESYS Control for IOT2000 SL\n* CODESYS Control for Linux ARM SL\n* CODESYS Control for Linux SL\n* CODESYS Control for PFC100 SL\n* CODESYS Control for PFC200 SL\n* CODESYS Control for PLCnext SL\n* CODESYS Control for Raspberry Pi SL\n* CODESYS Control for WAGO Touch Panels 600 SL\n* CODESYS Virtual Control SL \n\nThe CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/. ", "group_ids": [ "CSAFGID-1002" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 8.1, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.1, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51018" ] } ], "title": "Improper Synchronization in Monitoring in CODESYS Control Runtime" } ] }