A low‑privileged remote attacker may replace the boot application of the CODESYS Control runtime system. This replacement allows the attacker to run arbitrary code when the device boots, effectively granting full control over the system. The weakness involves unauthorized modification of a critical component (CWE‑669).

The vulnerability affects multiple CODESYS Control products, including CODESYS Control RTE for standard Linux (SL) and Beckhoff CX, CODESYS Control Win (SL), CODESYS Control for BeagleBone, IOT2000, Linux ARM, generic Linux, PFC100, PFC200, PLCnext, Raspberry Pi, WAGO Touch Panels 600, emPC‑A/iMX6, as well as the CODESYS HMI, Runtime Toolkit, and Virtual Control SL editions.

The CVSS score of 8.8 indicates a high severity vulnerability, and although EPSS data is not available, the vulnerability is exploitable by an attacker with low privileges. The attack vector is likely remote, inferred from the description that a remote attacker can replace the boot application. The vulnerability is not yet listed in the CISA KEV catalog, but its high impact and remote nature warrant immediate attention.