CVE-2025-41738

CVSS 7.5v3.1pub. 2025-12-01upd. 2026-02-23

An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Codesys Control For Beaglebone Sl
APP
Codesys
4.5.0.0 – 4.19.0.0 (excl.)
Codesys Control For Empc A\/imx6 Sl
APP
Codesys
4.5.0.0 – 4.19.0.0
Codesys Control For Iot2000 Sl
APP
Codesys
4.5.0.0 – 4.19.0.0 (excl.)
Codesys Control For Linux Arm Sl
APP
Codesys
4.5.0.0 – 4.19.0.0 (excl.)
Codesys Control For Linux Sl
APP
Codesys
4.5.0.0 – 4.19.0.0 (excl.)
Codesys Control For Pfc100 Sl
APP
Codesys
4.5.0.0 – 4.19.0.0
Codesys Control For Pfc200 Sl
APP
Codesys
4.5.0.0 – 4.19.0.0 (excl.)
Codesys Control For Plcnext Sl
APP
Codesys
4.5.0.0 – 4.19.0.0 (excl.)
Codesys Control For Raspberry Pi Sl
APP
Codesys
4.5.0.0 – 4.19.0.0 (excl.)
Codesys Control For Wago Touch Panels 600 Sl
APP
Codesys
4.5.0.0 – 4.19.0.0
Codesys Control Rte Sl
APP
Codesys
3.5.18.0 – 3.5.21.40 (excl.)
Codesys Control Rte Sl \(for Beckhoff Cx\)
APP
Codesys
3.5.18.0 – 3.5.21.40 (excl.)
Codesys Control Win Sl
APP
Codesys
3.5.18.0 – 3.5.21.40 (excl.)
Codesys Hmi Sl
APP
Codesys
3.5.18.0 – 3.5.21.40 (excl.)
Codesys Remote Target Visu
APP
Codesys
3.5.18.0 – 3.5.21.40 (excl.)
Codesys Runtime Toolkit
APP
Codesys
3.5.18.0 – 3.5.21.40 (excl.)
Codesys Virtual Control Sl
APP
Codesys
4.5.0.0 – 4.19.0.0 (excl.)