Codesys Development System
Approved changes feed: RSS · Atom
cpe:2.3:a:codesys:codesys_development_system:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Codesys (4a5dbd6f-1914-5b18-8641-403ab498c199) |
|---|---|
| Product | Codesys Development System (61c5e1e6-ef0a-5311-9403-288767db2402) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44469 |
vulnerable | 2026-06-08 08:05:11.094995 |
Incorrect Default Permissions in CODESYS Development System
HIGH (7.8)
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation.
Published: 2026-05-26T06:39:04.477Z
Updated: 2026-05-26T10:48:51.345Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44468 |
vulnerable | 2026-06-08 08:05:11.094781 |
Incorrect Default Permissions in CODESYS Development System
HIGH (7.8)
The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation by forcing the deployment of arbitrary components.
Published: 2026-05-26T06:37:53.259Z
Updated: 2026-05-26T10:49:05.531Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41700 |
vulnerable | 2026-06-08 07:25:07.759450 |
CODESYS Development System - Deserialization of Untrusted Data
HIGH (7.8)
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.
Published: 2025-12-01T10:02:47.312Z
Updated: 2025-12-01T13:59:26.310Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3670 |
vulnerable | 2026-06-08 06:09:40.147545 |
Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting
HIGH (7.3)
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.
Published: 2023-07-28T07:52:33.639Z
Updated: 2024-10-21T17:43:52.386Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3669 |
vulnerable | 2026-06-08 06:09:40.147035 |
CODESYS: Missing Brute-Force protection in CODESYS Development System
LOW (3.3)
A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
Published: 2023-08-03T11:11:05.068Z
Updated: 2025-02-27T21:11:19.916Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3663 |
vulnerable | 2026-06-08 06:09:40.138175 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3662 |
vulnerable | 2026-06-08 06:09:40.137072 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-31805 |
vulnerable | 2026-06-08 05:44:42.341775 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.