CVE-2025-41659: fallo de gravedad alta en CODESYS Control for BeagleBone SL
CODESYS Control PKI Exposure Enables Remote Certificate Access
Publicada el
Seguir esta CVE+ Monitorear CODESYS Control for BeagleBone SL+ Monitorear CODESYS Control for emPC-A/iMX6 SL
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.3epss 0.3%
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Productos afectados
CODESYS · Control for BeagleBone SLCODESYS · Control for emPC-A/iMX6 SLCODESYS · Control for IOT2000 SLCODESYS · Control for Linux ARM SLCODESYS · Control for Linux SLCODESYS · Control for PFC100 SLCODESYS · Control for PFC200 SLCODESYS · Control for PLCnext SLCODESYS · Control for Raspberry Pi SLCODESYS · Control for WAGO Touch Panels 600 SLCODESYS · Control RTE (for Beckhoff CX) SLCODESYS · Control RTE (SL)CODESYS · Control Win (SL)CODESYS · HMI (SL)CODESYS · Runtime ToolkitCODESYS · Virtual Control SLCVEs relacionadas — CODESYS Control for BeagleBone SL
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-4224HIGHCODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3EPSS 0.9%CVE-2025-41691HIGHCODESYS Control DoS via Unauthenticated NULL Pointer DereferenceEPSS 0.6%CVE-2026-79625HIGHImproper Synchronization in Monitoring in CODESYS Control RuntimeEPSS 0.2%CVE-2025-41658MEDIUMCODESYS Toolkit Exposes Sensitive Files via Default PermissionsEPSS 0.1%