The vulnerability arises when the CODESYS Development System extracts installation files into a temporary directory that is left with permissions that allow write access by lower‑privileged users. This incorrect default setting enables a low‑privileged local attacker to take advantage of a time‑of‑check-to-time‑of‑use race condition during administrative installation, replacing verified files with malicious ones before the installation process completes. The result is the attacker gaining elevated local privileges, a weakness identified as CWE‑276. The CVSS score of 8.5 marks the issue as high severity.

CODESYS Development System by CODESYS is the affected product. No specific affected versions are listed in the available data, so all releases of this product may be vulnerable until a patch is released.

The high CVSS score indicates significant impact if exploited. The EPSS score is not supplied, so the likelihood of exploitation cannot be quantified, though the exploitation requires only local presence and a usable timing window for the race condition. KEV is not listable, meaning there are no confirmed public exploits in the CISA catalog. Consequently, the risk remains high for any environment where CODESYS Development System is installed under administrative privileges, especially if low‑privileged users have access to the installation directory during the installation process.