CISA + vendors
ICS Advisories
Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.
1
Found
Advisory data: live connection— last retrieved: 7 November 2026 at 02:05.
Filters
1 active1 advisories found
Advisory2025-08_VDE-2025-070
CODESYS Control V3 - NULL pointer dereference
Risk evaluation
A vulnerability in the CODESYS Control runtime system's CmpDevice component allows unauthenticated attackers to cause a denial-of-service (DoS) via specially crafted communication requests. The issue is triggered by a NULL pointer dereference and also affects systems when outdated CODESYS clients attempt to log in. Only PLCs based on the CODESYS Runtime Toolkit containing the components CmpDevice, CmpAuditLog, and CmpSessionInformation are impacted. **Update 1.1.0, 01.09.2025:** Updated remediation category - fixed SL runtimes are now available.
Mitigation summary
The vulnerability can be mitigated by restricting the allowed login authentication type "CmpUserMgr/UserLogin_AuthenticationType" to "ONLY_ASYMMETRIC". This can be configured either via the Device Security Settings dialog in the CODESYS Development System or directly in the configuration file of the CODESYS Control runtime system (CODESYSControl.cfg) by adding the following setting: [CmpUserMgr] SECURITY.UserLogin_AuthenticationType=ONLY_ASYMMETRIC With this configuration in place, both potential attackers and legacy CODESYS protocol clients (prior to version 3.5.16.0) will be blocked from logging in, thereby preventing execution of the vulnerable code path.
Revision history (3)
Initial publication — 4 August 2025
Initial revision.
Update A — 1 September 2025
Updated remediation category - fixed SL runtimes are now available.
Update B — 14 October 2025
List of affected and fixed products corrected regarding CODESYS HMI (SL) and CODESYS Runtime Toolkit