Read the docs
TI-2023-03427 Aliases CVE-2023-3670GHSA-h29m-qm63-f57f

Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting

Priority LOW 31CWE-668Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.002 9th percentileScored 2026-11-07
Fix Fixed CODESYS Development System (CODESYS): 3.5.17.0CODESYS Scripting (CODESYS): 4.1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSCODESYS Development System3.5.9.0 to before 3.5.17.03.5.17.0Patch availableCNA
CODESYSCODESYS Scripting4.0.0.0 to before 4.1.0.04.1.0.0Patch availableCNA
  • CODESYS Development System VendorCODESYS Affected 3.5.9.0 to before 3.5.17.0 Fixed in 3.5.17.0 Patch available CNA
  • CODESYS Scripting VendorCODESYS Affected 4.0.0.0 to before 4.1.0.0 Fixed in 4.1.0.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*3.5.9.0 to before 3.5.17.0VulnerableCODESYS
cpe:2.3:a:codesys:scripting:*:*:*:*:*:*:*:*4.0.0.0 to before 4.1.0.0VulnerableCODESYS
  • cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:* Versions 3.5.9.0 to before 3.5.17.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:scripting:*:*:*:*:*:*:*:* Versions 4.0.0.0 to before 4.1.0.0 Vulnerable ·CODESYS

Remediation

  • Fix · CNA CODESYS Development System (CODESYS) Fixed in 3.5.17.0
  • Fix · CNA CODESYS Scripting (CODESYS) Fixed in 4.1.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3670
  2. 2026-10-03 Alias added: GHSA-h29m-qm63-f57f

References

Advisory 1

  • TI-2019-06497 An issue was discovered in 3S-Smart CODESYS V3 products. CVSS 3.1CRITICAL 9.8
  • TI-2023-03420 CODESYS: Missing integrity check in CODESYS Development System CVSS 3.1HIGH 8.8
  • TI-2022-03868 CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3 CVSS 3.1HIGH 8.8
  • TI-2021-10055 CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS). CVSS 3.1HIGH 7.5
  • TI-2026-32408 Incorrect Default Permissions in CODESYS Development System CVSS 4.0HIGH 8.5
  • TI-2026-32407 Incorrect Default Permissions in CODESYS Development System CVSS 4.0HIGH 8.5
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences