PT-2025-31799 · Codesys · Codesys Control

Luca Borzacchiello · Published 2025-08-04 · Updated 2026-04-27 · CVE-2025-41659

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

AV:N/AC:L/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions CODESYS Control (affected versions not specified)

Description A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system. This allows the attacker to read and write certificates and their keys, potentially enabling the extraction of sensitive data or the acceptance of certificates as trusted. If the certificates are deleted, only unencrypted communication is possible, while all services remain available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2026-00081

CVE-2025-41659

Affected Products

Codesys Control

References · 9

• https://bdu.fstec.ru/vul/2026-00081 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-41659 · Security Note
• https://certvde.com/de/advisories/VDE-2025-051 · Note
• https://twitter.com/blackorbird/status/2048422524636242217 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1swz840/top_10_trending_cves_27042026 · Reddit Post
• https://t.me/cveNotify/130733 · Telegram Post
• https://t.me/CVEtracker/29078 · Telegram Post
• https://twitter.com/CVEnew/status/1952292254367858803 · Twitter Post
• https://twitter.com/cracbot/status/1954135612644036731 · Twitter Post