CVE-2025-41659

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2025
Source publication: Aug 4, 2025
Source updated: Aug 4, 2025
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

CODESYS Control PKI Exposure Enables Remote Certificate Access

A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Control RTE (SL)

Vendor: CODESYS
Product: Control RTE (SL)
Platforms: Unknown
Default status: unaffected

Control RTE (SL) · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	3.5.21.20	Unavailable	None listed

Control RTE (for Beckhoff CX) SL

Vendor: CODESYS
Product: Control RTE (for Beckhoff CX) SL
Platforms: Unknown
Default status: unaffected

Control RTE (for Beckhoff CX) SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	3.5.21.20	Unavailable	None listed

Control Win (SL)

Vendor: CODESYS
Product: Control Win (SL)
Platforms: Unknown
Default status: unaffected

Control Win (SL) · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	3.5.21.20	Unavailable	None listed

HMI (SL)

Vendor: CODESYS
Product: HMI (SL)
Platforms: Unknown
Default status: unaffected

HMI (SL) · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	3.5.21.20	Unavailable	None listed

Runtime Toolkit

Vendor: CODESYS
Product: Runtime Toolkit
Platforms: Unknown
Default status: unaffected

Runtime Toolkit · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	3.5.21.20	Unavailable	None listed

Control for BeagleBone SL

Vendor: CODESYS
Product: Control for BeagleBone SL
Platforms: Unknown
Default status: unaffected

Control for BeagleBone SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	4.17.0.0	Unavailable	None listed

Control for emPC-A/iMX6 SL

Vendor: CODESYS
Product: Control for emPC-A/iMX6 SL
Platforms: Unknown
Default status: unaffected

Control for emPC-A/iMX6 SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	4.17.0.0	Unavailable	None listed

Control for IOT2000 SL

Vendor: CODESYS
Product: Control for IOT2000 SL
Platforms: Unknown
Default status: unaffected

Control for IOT2000 SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	4.17.0.0	Unavailable	None listed

Control for Linux ARM SL

Vendor: CODESYS
Product: Control for Linux ARM SL
Platforms: Unknown
Default status: unaffected

Control for Linux ARM SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	4.17.0.0	Unavailable	None listed

Control for Linux SL

Vendor: CODESYS
Product: Control for Linux SL
Platforms: Unknown
Default status: unaffected

Control for Linux SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	4.17.0.0	Unavailable	None listed

Control for PFC100 SL

Vendor: CODESYS
Product: Control for PFC100 SL
Platforms: Unknown
Default status: unaffected

Control for PFC100 SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	4.17.0.0	Unavailable	None listed

Control for PFC200 SL

Vendor: CODESYS
Product: Control for PFC200 SL
Platforms: Unknown
Default status: unaffected

Control for PFC200 SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	4.17.0.0	Unavailable	None listed

Control for PLCnext SL

Vendor: CODESYS
Product: Control for PLCnext SL
Platforms: Unknown
Default status: unaffected

Control for PLCnext SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	4.17.0.0	Unavailable	None listed

Control for Raspberry Pi SL

Vendor: CODESYS
Product: Control for Raspberry Pi SL
Platforms: Unknown
Default status: unaffected

Control for Raspberry Pi SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	4.17.0.0	Unavailable	None listed

Control for WAGO Touch Panels 600 SL

Vendor: CODESYS
Product: Control for WAGO Touch Panels 600 SL
Platforms: Unknown
Default status: unaffected

Control for WAGO Touch Panels 600 SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	4.17.0.0	Unavailable	None listed

Virtual Control SL

Vendor: CODESYS
Product: Virtual Control SL
Platforms: Unknown
Default status: unaffected

Virtual Control SL · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0.0.0.0	`affected`	semver	4.17.0.0	Unavailable	None listed