An authenticated, low‑privileged remote user can delete any user account on affected CODESYS Control installations, including accounts with higher privileges. This weakness allows an attacker to remove legitimate users, thereby disabling critical functions, potentially leading to a denial of service for privileged operations, and exposing the system to further compromise. The vulnerability is a missing authorization check during user deletion.

All CODESYS Control products listed by the CNA are impacted, including CODESYS Control RTE (SL), CODESYS Control RTE for Beckhoff CX, CODESYS Control Win, CODESYS Control for BeagleBone, IOT2000, Linux ARM, Linux, PFC100, PFC200, PLCnext, Raspberry Pi, WAGO Touch Panels 600, emPC‑A/iMX6, CODESYS HMI, CODESYS Runtime Toolkit, and CODESYS Virtual Control SL. Specific affected firmware versions are not disclosed in the advisory.

The CVSS score of 7.2 indicates a high‑severity vulnerability. EPSS data is unavailable, and the weakness is not presently listed in CISA’s KEV catalog. Exploitation requires only a valid authenticated session with low‑privileged rights; the attacker can then issue delete commands for arbitrary accounts. Because the vulnerability operates in a remote context and bypasses authorization, the risk of accidental deletion or malicious removal of critical accounts is significant, warranting urgent attention.