Read the docs
TI-2026-55135 Aliases CVE-2026-79625GHSA-crvr-hhmx-9hp6

Improper Synchronization in Monitoring in CODESYS Control Runtime

Priority LOW 31CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Fix Fixed Control RTE (SL) (CODESYS): 3.5.22.40Control RTE (for Beckhoff CX) SL (CODESYS): 3.5.22.40+16 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSControl RTE (SL)3.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSControl RTE (for Beckhoff CX) SL3.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSControl Win (SL)3.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSRuntime Toolkit3.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSSafety SIL23.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSHMI (SL)3.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSDevelopment System 33.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSControl for BeagleBone SL3.5.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
CODESYSControl for emPC-A/iMX6 SL3.5.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
CODESYSControl for IOT2000 SL3.5.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
CODESYSControl for Linux ARM SL3.5.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
CODESYSControl for Linux SL3.5.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
CODESYSControl for PFC100 SL3.5.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
CODESYSControl for PFC200 SL3.5.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
CODESYSControl for PLCnext SL3.5.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
CODESYSControl for Raspberry Pi SL3.5.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
CODESYSControl for WAGO Touch Panels 600 SL3.5.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
CODESYSVirtual Control SL3.5.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
  • Control RTE (SL) VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • Control RTE (for Beckhoff CX) SL VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • Control Win (SL) VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • Runtime Toolkit VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • Safety SIL2 VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • HMI (SL) VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • Development System 3 VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • Control for BeagleBone SL VendorCODESYS Affected 3.5.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA
  • Control for emPC-A/iMX6 SL VendorCODESYS Affected 3.5.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA
  • Control for IOT2000 SL VendorCODESYS Affected 3.5.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA
  • Control for Linux ARM SL VendorCODESYS Affected 3.5.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA
  • Control for Linux SL VendorCODESYS Affected 3.5.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA
  • Control for PFC100 SL VendorCODESYS Affected 3.5.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA
  • Control for PFC200 SL VendorCODESYS Affected 3.5.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA
  • Control for PLCnext SL VendorCODESYS Affected 3.5.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA
  • Control for Raspberry Pi SL VendorCODESYS Affected 3.5.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA
  • Control for WAGO Touch Panels 600 SL VendorCODESYS Affected 3.5.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA
  • Virtual Control SL VendorCODESYS Affected 3.5.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA

Remediation

  • Fix · CNA Control RTE (SL) (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA Control RTE (for Beckhoff CX) SL (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA Control Win (SL) (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA Runtime Toolkit (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA Safety SIL2 (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA HMI (SL) (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA Development System 3 (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA Control for BeagleBone SL (CODESYS) Fixed in 4.23.0.0
  • Fix · CNA Control for emPC-A/iMX6 SL (CODESYS) Fixed in 4.23.0.0
  • Fix · CNA Control for IOT2000 SL (CODESYS) Fixed in 4.23.0.0
  • Fix · CNA Control for Linux ARM SL (CODESYS) Fixed in 4.23.0.0
  • Fix · CNA Control for Linux SL (CODESYS) Fixed in 4.23.0.0
  • Fix · CNA Control for PFC100 SL (CODESYS) Fixed in 4.23.0.0
  • Fix · CNA Control for PFC200 SL (CODESYS) Fixed in 4.23.0.0
  • Fix · CNA Control for PLCnext SL (CODESYS) Fixed in 4.23.0.0
  • Fix · CNA Control for Raspberry Pi SL (CODESYS) Fixed in 4.23.0.0
  • Fix · CNA Control for WAGO Touch Panels 600 SL (CODESYS) Fixed in 4.23.0.0
  • Fix · CNA Virtual Control SL (CODESYS) Fixed in 4.23.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    CODESYS Development System 3, HMI (SL), Runtime Toolkit 3.5.22.40

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-53779 Uncontrolled Memory Allocation in CODESYS Gateway ClientPriority MEDIUM 44
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-79625
  2. 2026-10-03 Alias added: GHSA-crvr-hhmx-9hp6

References

Other 1

  • TI-2021-12888 CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2019-10180 Stack-based buffer overflow in CODESYS V3 web server CVSS 3.1CRITICAL 9.8
  • TI-2021-13604 CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS) CVSS 3.1HIGH 7.5
  • TI-2020-08257 CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. CVSS 3.1CRITICAL 9.8
  • TI-2019-13592 CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2017-03937 Unrestricted file upload in 3S-Smart Software Solutions GmbH CODESYS Web Server CVSS 3.0CRITICAL 9.8
See all 155 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences