Vulnerability details
CVE-2025-41691
CODESYS Control RTECODESYS Control RTE SLCODESYS Control WinCODESYS Control for BeagleBone SLCODESYS Control for IOT2000 SLCODESYS Control for Linux ARM SL
CODESYS Control DoS via Unauthenticated NULL Pointer Dereference
CVSS 3.1
7.5High
Official description
An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (CERTVDE) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| CODESYS | Control RTE (SL) | 3.5.21.10 ≤ v < 3.5.21.20 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control RTE (for Beckhoff CX) SL | 3.5.21.10 ≤ v < 3.5.21.20 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control Win (SL) | 3.5.21.10 ≤ v < 3.5.21.20 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control for BeagleBone SL | 4.16.0.0 ≤ v < 4.17.0.0 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control for IOT2000 SL | 4.16.0.0 ≤ v < 4.17.0.0 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control for Linux ARM SL | 4.16.0.0 ≤ v < 4.17.0.0 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control for Linux SL | 4.16.0.0 ≤ v < 4.17.0.0 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control for PFC100 SL | 4.16.0.0 ≤ v < 4.17.0.0 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control for PFC200 SL | 4.16.0.0 ≤ v < 4.17.0.0 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control for PLCnext SL | 4.16.0.0 ≤ v < 4.17.0.0 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control for Raspberry Pi SL | 4.16.0.0 ≤ v < 4.17.0.0 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control for WAGO Touch Panels 600 SL | 4.16.0.0 ≤ v < 4.17.0.0 | CVEProject cvelistV5 (CNA) |
| CODESYS | Control for emPC-A/iMX6 SL | 4.16.0.0 ≤ v < 4.17.0.0 | CVEProject cvelistV5 (CNA) |
| CODESYS | HMI (SL) | 3.5.21.10 ≤ v < 3.5.21.20 | CVEProject cvelistV5 (CNA) |
| CODESYS | Virtual Control SL | 4.16.0.0 ≤ v < 4.17.0.0 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-08-04
- Last updated
- 2025-08-04
- State
- Published
- Assigner (CNA)
- CERTVDE
Exploit prediction (EPSS)
0.63%
Probability of exploitation in 30 days
50.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-476NULL Pointer Dereference