CODESYS CODESYS Control RTE (SL) — kwetsbaarheid CVE-2025-41659

A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Update the following products to version 3.5.21.20. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/. Following our general recommendation that the PKI should only be managed via the dedicated X.509 API or the corresponding online services of the CODESYS Control runtime system, the programmatic direct access via SysFile or SysDir operations or online access via the CODESYS file transfer services is denied after an update to a fixed product version. For compatibility reasons, the old behavior can be restored for applications that use these accesses via the following setting: [CmpOpenSSL] EnforceBlacklistOnPKIDir=0 However, we strongly recommend keeping the new default.