Read the docs
TI-2025-27700 Aliases CVE-2025-41738GHSA-7pvj-rp26-vxxc

CODESYS Control - Invalid type usage in visualization

Priority LOW 39CWE-843Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-843 and the CVSS impact.

Summary

An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix Fixed CODESYS Control RTE (SL) (CODESYS): 3.5.21.40CODESYS Control RTE (for Beckhoff CX) SL (CODESYS): 3.5.21.40+15 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSCODESYS Control RTE (SL)3.5.18.0 to before 3.5.21.403.5.21.40Patch availableCNA
CODESYSCODESYS Control RTE (for Beckhoff CX) SL3.5.18.0 to before 3.5.21.403.5.21.40Patch availableCNA
CODESYSCODESYS Control Win (SL)3.5.18.0 to before 3.5.21.403.5.21.40Patch availableCNA
CODESYSCODESYS HMI (SL)3.5.18.0 to before 3.5.21.403.5.21.40Patch availableCNA
CODESYSCODESYS Remote Target Visu3.5.18.0 to before 3.5.21.403.5.21.40Patch availableCNA
CODESYSCODESYS Runtime Toolkit3.5.18.0 to before 3.5.21.403.5.21.40Patch availableCNA
CODESYSCODESYS Control for BeagleBone SL4.5.0.0 to before 4.19.0.04.19.0.0Patch availableCNA
CODESYSCODESYS Control for emPC-A/iMX6 SL4.5.0.0 to before 4.19.0.04.19.0.0Patch availableCNA
CODESYSCODESYS Control for IOT2000 SL4.5.0.0 to before 4.19.0.04.19.0.0Patch availableCNA
CODESYSCODESYS Control for Linux ARM SL4.5.0.0 to before 4.19.0.04.19.0.0Patch availableCNA
CODESYSCODESYS Control for Linux SL4.5.0.0 to before 4.19.0.04.19.0.0Patch availableCNA
CODESYSCODESYS Control for PFC100 SL4.5.0.0 to before 4.19.0.04.19.0.0Patch availableCNA
CODESYSCODESYS Control for PFC200 SL4.5.0.0 to before 4.19.0.04.19.0.0Patch availableCNA
CODESYSCODESYS Control for PLCnext SL4.5.0.0 to before 4.19.0.04.19.0.0Patch availableCNA
CODESYSCODESYS Control for Raspberry Pi SL4.5.0.0 to before 4.19.0.04.19.0.0Patch availableCNA
CODESYSCODESYS Control for WAGO Touch Panels 600 SL4.5.0.0 to before 4.19.0.04.19.0.0Patch availableCNA
CODESYSCODESYS Virtual Control SL4.5.0.0 to before 4.19.0.04.19.0.0Patch availableCNA
  • CODESYS Control RTE (SL) VendorCODESYS Affected 3.5.18.0 to before 3.5.21.40 Fixed in 3.5.21.40 Patch available CNA
  • CODESYS Control RTE (for Beckhoff CX) SL VendorCODESYS Affected 3.5.18.0 to before 3.5.21.40 Fixed in 3.5.21.40 Patch available CNA
  • CODESYS Control Win (SL) VendorCODESYS Affected 3.5.18.0 to before 3.5.21.40 Fixed in 3.5.21.40 Patch available CNA
  • CODESYS HMI (SL) VendorCODESYS Affected 3.5.18.0 to before 3.5.21.40 Fixed in 3.5.21.40 Patch available CNA
  • CODESYS Remote Target Visu VendorCODESYS Affected 3.5.18.0 to before 3.5.21.40 Fixed in 3.5.21.40 Patch available CNA
  • CODESYS Runtime Toolkit VendorCODESYS Affected 3.5.18.0 to before 3.5.21.40 Fixed in 3.5.21.40 Patch available CNA
  • CODESYS Control for BeagleBone SL VendorCODESYS Affected 4.5.0.0 to before 4.19.0.0 Fixed in 4.19.0.0 Patch available CNA
  • CODESYS Control for emPC-A/iMX6 SL VendorCODESYS Affected 4.5.0.0 to before 4.19.0.0 Fixed in 4.19.0.0 Patch available CNA
  • CODESYS Control for IOT2000 SL VendorCODESYS Affected 4.5.0.0 to before 4.19.0.0 Fixed in 4.19.0.0 Patch available CNA
  • CODESYS Control for Linux ARM SL VendorCODESYS Affected 4.5.0.0 to before 4.19.0.0 Fixed in 4.19.0.0 Patch available CNA
  • CODESYS Control for Linux SL VendorCODESYS Affected 4.5.0.0 to before 4.19.0.0 Fixed in 4.19.0.0 Patch available CNA
  • CODESYS Control for PFC100 SL VendorCODESYS Affected 4.5.0.0 to before 4.19.0.0 Fixed in 4.19.0.0 Patch available CNA
  • CODESYS Control for PFC200 SL VendorCODESYS Affected 4.5.0.0 to before 4.19.0.0 Fixed in 4.19.0.0 Patch available CNA
  • CODESYS Control for PLCnext SL VendorCODESYS Affected 4.5.0.0 to before 4.19.0.0 Fixed in 4.19.0.0 Patch available CNA
  • CODESYS Control for Raspberry Pi SL VendorCODESYS Affected 4.5.0.0 to before 4.19.0.0 Fixed in 4.19.0.0 Patch available CNA
  • CODESYS Control for WAGO Touch Panels 600 SL VendorCODESYS Affected 4.5.0.0 to before 4.19.0.0 Fixed in 4.19.0.0 Patch available CNA
  • CODESYS Virtual Control SL VendorCODESYS Affected 4.5.0.0 to before 4.19.0.0 Fixed in 4.19.0.0 Patch available CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*4.5.0.0 to before 4.19.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:*4.5.0.0 – 4.19.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*4.5.0.0 to before 4.19.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_linux_arm_sl:*:*:*:*:*:*:*:*4.5.0.0 to before 4.19.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*4.5.0.0 to before 4.19.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*4.5.0.0 – 4.19.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*4.5.0.0 to before 4.19.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*4.5.0.0 to before 4.19.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*4.5.0.0 to before 4.19.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*4.5.0.0 – 4.19.0.0VulnerableCODESYS
  • cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:* Versions 4.5.0.0 to before 4.19.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:* Versions 4.5.0.0 – 4.19.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:* Versions 4.5.0.0 to before 4.19.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_linux_arm_sl:*:*:*:*:*:*:*:* Versions 4.5.0.0 to before 4.19.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:* Versions 4.5.0.0 to before 4.19.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:* Versions 4.5.0.0 – 4.19.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:* Versions 4.5.0.0 to before 4.19.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:* Versions 4.5.0.0 to before 4.19.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:* Versions 4.5.0.0 to before 4.19.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:* Versions 4.5.0.0 – 4.19.0.0 Vulnerable ·CODESYS
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*3.5.18.0 to before 3.5.21.40VulnerableCODESYS
cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:*3.5.18.0 to before 3.5.21.40VulnerableCODESYS
cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*3.5.18.0 to before 3.5.21.40VulnerableCODESYS
cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*3.5.18.0 to before 3.5.21.40VulnerableCODESYS
cpe:2.3:a:codesys:remote_target_visu:*:*:*:*:*:*:*:*3.5.18.0 to before 3.5.21.40VulnerableCODESYS
cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:*:*3.5.18.0 to before 3.5.21.40VulnerableCODESYS
cpe:2.3:a:codesys:virtual_control_sl:*:*:*:*:*:*:*:*4.5.0.0 to before 4.19.0.0VulnerableCODESYS
  • cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:* Versions 3.5.18.0 to before 3.5.21.40 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:* Versions 3.5.18.0 to before 3.5.21.40 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:* Versions 3.5.18.0 to before 3.5.21.40 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:* Versions 3.5.18.0 to before 3.5.21.40 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:remote_target_visu:*:*:*:*:*:*:*:* Versions 3.5.18.0 to before 3.5.21.40 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:*:* Versions 3.5.18.0 to before 3.5.21.40 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:virtual_control_sl:*:*:*:*:*:*:*:* Versions 4.5.0.0 to before 4.19.0.0 Vulnerable ·CODESYS

Remediation

  • Fix · CNA CODESYS Control RTE (SL) (CODESYS) Fixed in 3.5.21.40
  • Fix · CNA CODESYS Control RTE (for Beckhoff CX) SL (CODESYS) Fixed in 3.5.21.40
  • Fix · CNA CODESYS Control Win (SL) (CODESYS) Fixed in 3.5.21.40
  • Fix · CNA CODESYS HMI (SL) (CODESYS) Fixed in 3.5.21.40
  • Fix · CNA CODESYS Remote Target Visu (CODESYS) Fixed in 3.5.21.40
  • Fix · CNA CODESYS Runtime Toolkit (CODESYS) Fixed in 3.5.21.40
  • Fix · CNA CODESYS Control for BeagleBone SL (CODESYS) Fixed in 4.19.0.0
  • Fix · CNA CODESYS Control for emPC-A/iMX6 SL (CODESYS) Fixed in 4.19.0.0
  • Fix · CNA CODESYS Control for IOT2000 SL (CODESYS) Fixed in 4.19.0.0
  • Fix · CNA CODESYS Control for Linux ARM SL (CODESYS) Fixed in 4.19.0.0
  • Fix · CNA CODESYS Control for Linux SL (CODESYS) Fixed in 4.19.0.0
  • Fix · CNA CODESYS Control for PFC100 SL (CODESYS) Fixed in 4.19.0.0
  • Fix · CNA CODESYS Control for PFC200 SL (CODESYS) Fixed in 4.19.0.0
  • Fix · CNA CODESYS Control for PLCnext SL (CODESYS) Fixed in 4.19.0.0
  • Fix · CNA CODESYS Control for Raspberry Pi SL (CODESYS) Fixed in 4.19.0.0
  • Fix · CNA CODESYS Control for WAGO Touch Panels 600 SL (CODESYS) Fixed in 4.19.0.0
  • Fix · CNA CODESYS Virtual Control SL (CODESYS) Fixed in 4.19.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    CODESYS Control for BeagleBone SL, CODESYS Control for IOT2000 SL and 11 more products 3.5.21.40, 4.19.0.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-27701 CODESYS Control - Linux/QNX SysSocket flawPriority LOW 27
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41738
  2. 2026-10-03 Alias added: GHSA-7pvj-rp26-vxxc

References

Advisory 1

  • TI-2019-06497 An issue was discovered in 3S-Smart CODESYS V3 products. CVSS 3.1CRITICAL 9.8
  • TI-2018-07501 Improper access control in 3S-Smart Software Solutions GmbH CODESYS Control V3 products… CVSS 3.0CRITICAL 9.8
  • TI-2022-23467 CODESYS: Multiple products prone to out-of-bounds write CVSS 3.1HIGH 8.8
  • TI-2022-23479 CODESYS: Multiple products prone to Improper Input Validation CVSS 3.1HIGH 7.5
  • TI-2022-23478 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
  • TI-2022-23477 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences