CVE-2025-41739

An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a denial of service.

Score

CVSS 3.1 5.9 Medium

Status

Deferred - info@cert.vde.com

Published

2025-12-01

Last modified

2026-01-07

Weaknesses

CWE-125

Affected products

• Codesys Control For Beaglebone Sl (Codesys)
• Codesys Control For Empc-aimx6 Sl (Codesys)
• Codesys Control For Iot2000 Sl (Codesys)
• Codesys Control For Linux Arm Sl (Codesys)
• Codesys Control For Linux Sl (Codesys)
• Codesys Control For Pfc100 Sl (Codesys)
• Codesys Control For Pfc200 Sl (Codesys)
• Codesys Control For Plcnext Sl (Codesys)
• Codesys Control For Raspberry Pi Sl (Codesys)
• Codesys Control For Wago Touch Panels 600 Sl (Codesys)
• Codesys Edge Gateway For Linux (Codesys)
• Codesys Plchandler (Codesys)
• Codesys Remote Target Visu (Codesys)
• Codesys Runtime Toolkit (Codesys)
• Codesys Targetvisu For Linux Sl (Codesys)
• Codesys Virtual Control Sl (Codesys)

References

• https://certvde.com/de/advisories/VDE-2025-099