PT-2025-48433 · Codesys · Codesys Control Runtime

Published 2025-12-01 · Updated 2026-02-23 · CVE-2025-41738

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CODESYS Control Runtime (affected versions not specified)

Description An unauthenticated remote attacker can cause the visualization server of the CODESYS Control runtime system to access a resource with an incorrect pointer type, potentially leading to a denial-of-service (DoS) condition. This issue does not require authentication for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BDU:2025-16471

CVE-2025-41738

Affected Products

Codesys Control Runtime

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-41738 · Security Note
• https://bdu.fstec.ru/vul/2025-16471 · Security Note
• https://osv.dev/vulnerability/CVE-2025-41738 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1995445774377779658 · Twitter Post
• https://t.me/cveNotify/144387 · Telegram Post
• https://twitter.com/cracbot/status/1997259804121964705 · Twitter Post
• https://certvde.com/de/advisories/VDE-2025-100 · Note
• https://t.me/CVEtracker/38528 · Telegram Post
• https://t.me/cveNotify/152872 · Telegram Post
• https://store.codesys.com/en/codesys.html · Note
• https://twitter.com/CVEnew/status/1995437680453124423 · Twitter Post
• https://api-www.codesys.com/fileadmin/user_upload/CODESYS_Group/Ecosystem/Up-to-Date/Security/Security-Advisories/Advisory2025-10_CDS-94939.pdf · Note