Technical impact
The vulnerability is a race condition in the CODESYS Modbus TCP Server stack that causes the server to fail to correctly manage available TCP connections. An unauthenticated attacker can exploit this flaw to exhaust all connection slots, resulting in legitimate clients being unable to establish new connections. This flaw maps to CWE‑772: Improper Management of Resource Decay.
Affected Systems
The affected vendor is CODESYS and the product is CODESYS Modbus. No specific version information is provided in the available data, so the scope could apply to any installation that includes the Modbus TCP Server stack.
Risk and Exploitability
The CVSS score of 8.2 indicates a high severity level and the lack of an EPSS score means the current probability of exploitation is unknown. The vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector is remote and does not require authentication; an attacker would issue crafted traffic or flood the server with connection attempts to trigger the race condition and exhaust resources.
