CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00016.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
CODESYS Runtime Toolkit unaffected
Version Status Constraints
0.0.0.0 affected
< 3.5.21.20
CODESYS Control for BeagleBone SL unaffected
Version Status Constraints
0.0.0.0 affected
< 4.16.0.0
CODESYS Control for emPC-A/iMX6 SL unaffected
Version Status Constraints
0.0.0.0 affected
< 4.16.0.0
CODESYS Control for IOT2000 SL unaffected
Version Status Constraints
0.0.0.0 affected
< 4.16.0.0
CODESYS Control for Linux ARM SL unaffected
Version Status Constraints
0.0.0.0 affected
< 4.16.0.0
CODESYS Control for Linux SL unaffected
Version Status Constraints
0.0.0.0 affected
< 4.16.0.0
CODESYS Control for PFC100 SL unaffected
Version Status Constraints
0.0.0.0 affected
< 4.16.0.0
CODESYS Control for PFC200 SL unaffected
Version Status Constraints
0.0.0.0 affected
< 4.16.0.0
CODESYS Control for PLCnext SL unaffected
Version Status Constraints
0.0.0.0 affected
< 4.16.0.0
CODESYS Control for Raspberry Pi SL unaffected
Version Status Constraints
0.0.0.0 affected
< 4.16.0.0
CODESYS Control for WAGO Touch Panels 600 SL unaffected
Version Status Constraints
0.0.0.0 affected
< 4.16.0.0
CODESYS Virtual Control SL unaffected
Version Status Constraints
0.0.0.0 affected
< 4.16.0.0

No data.

No data.

Vendor Product Confidence Versions
Codesys Control — —

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Subscriptions

Vendors Products
Codesys Subscribe
Control Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-23492 CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://certvde.com/de/advisories/VDE-2025-049 cve-icon cve-icon
History

Tue, 05 Aug 2025 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Codesys
Codesys control
Vendors & Products Codesys
Codesys control

Mon, 04 Aug 2025 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 04 Aug 2025 08:15:00 +0000

Type Values Removed Values Added
Description CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
Title CODESYS Toolkit Exposes Sensitive Files via Default Permissions
Weaknesses CWE-276
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published:

Updated: 2025-08-04T11:52:37.949Z

Reserved: 2025-04-16T11:17:48.306Z

Link: CVE-2025-41658

cve-icon Vulnrichment

Updated: 2025-08-04T11:52:34.939Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-08-04T08:15:47.950

Modified: 2025-08-04T15:06:15.833

Link: CVE-2025-41658

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-08-05T11:38:59Z

Weaknesses