« Volver al listado

CVE-2025-41658

Estado: AplazadaMedia (5.5)—

CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Codesys — Runtime ToolkitAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-41658",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-41658",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-04T11:52:31.347383Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "CODESYS",
          "product": "Runtime Toolkit",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "3.5.21.20",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "Control for BeagleBone SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "4.16.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "Control for emPC-A/iMX6 SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "4.16.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "Control for IOT2000 SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "4.16.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "Control for Linux ARM SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "4.16.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "Control for Linux SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "4.16.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "Control for PFC100 SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "4.16.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "Control for PFC200 SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "4.16.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "Control for PLCnext SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "4.16.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "Control for Raspberry Pi SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "4.16.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "Control for WAGO Touch Panels 600 SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "4.16.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "Virtual Control SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0.0",
              "lessThan": "4.16.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-08-04T08:15:47.950",
  "references": [
    {
      "url": "https://certvde.com/de/advisories/VDE-2025-049",
      "source": "info@cert.vde.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions."
    },
    {
      "lang": "es",
      "value": "Los productos basados en CODESYS Runtime Toolkit pueden exponer archivos confidenciales a usuarios del sistema operativo local con pocos privilegios debido a los permisos de archivo predeterminados."
    }
  ],
  "lastModified": "2026-06-17T09:22:54.670",
  "sourceIdentifier": "info@cert.vde.com"
}