CVE-2023-3670highCWE-668

CVE-2023-3670: high-severity vulnerability in CODESYS Development System

Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting

Published · Updated

Follow this CVE+ Monitor CODESYS Development System+ Monitor CODESYS Scripting

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.2%
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
CODESYS · CODESYS Development SystemCODESYS · CODESYS Scripting
Related CVEs — CODESYS Development System

In the same product, most dangerous first.

CVE-2022-31805HIGHInsecure transmission of credentialsEPSS 1.0%CVE-2023-3663HIGHCODESYS: Missing integrity check in CODESYS Development SystemEPSS 1.0%CVE-2023-3662HIGHCODESYS: Vulnerability in CODESYS Development System allows for execution of binariesEPSS 0.2%CVE-2025-41700HIGHCODESYS Development System - Deserialization of Untrusted DataEPSS 0.2%CVE-2023-3669LOWCODESYS: Missing Brute-Force protection in CODESYS Development SystemEPSS 0.1%CVE-2026-44468HIGHIncorrect Default Permissions in CODESYS Development SystemEPSS 0.1%