CVE-2025-41659
Estado: AplazadaAlta (8.3)—
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
- Puntuación base: 8.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.22%
- Percentil entre todas las CVEs puntuadas: 12
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1210Exploitation of Remote Serviceslateral movement85 % - Impacto principal
T1552.007Container APIcredential access90 % - Impacto secundario
T1556.004Network Device Authenticationdefense impairment · persistence · credential access80 % - Impacto secundario
T1565.001Stored Data Manipulationimpact85 %
Vulnerabilidad remota (AV:N) con PR:L que permite acceso no autorizado a carpeta PKI. Atacante lee claves privadas (T1552.007), manipula certificados (T1565.001) e impone certificados falsos como confiables (T1556.004 PKI/firmas).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-732
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-41659",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-41659",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-08-04T16:34:47.316036Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "info@cert.vde.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.3,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.5,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "info@cert.vde.com",
"affectedData": [
{
"vendor": "CODESYS",
"product": "Control RTE (SL)",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "3.5.21.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control RTE (for Beckhoff CX) SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "3.5.21.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control Win (SL)",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "3.5.21.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "HMI (SL)",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "3.5.21.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Runtime Toolkit",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "3.5.21.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for BeagleBone SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for emPC-A/iMX6 SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for IOT2000 SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for Linux ARM SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for Linux SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for PFC100 SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for PFC200 SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for PLCnext SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for Raspberry Pi SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for WAGO Touch Panels 600 SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Virtual Control SL",
"versions": [
{
"status": "affected",
"version": "0.0.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2025-08-04T08:15:48.173",
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-051",
"source": "info@cert.vde.com"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "info@cert.vde.com",
"description": [
{
"lang": "en",
"value": "CWE-732"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted."
},
{
"lang": "es",
"value": "Un atacante con pocos privilegios puede acceder remotamente a la carpeta PKI del sistema de ejecución de CODESYS Control y, por lo tanto, leer y escribir certificados y sus claves. Esto permite extraer datos confidenciales o aceptar certificados como de confianza. Aunque todos los servicios permanecen disponibles, solo es posible la comunicación sin cifrar si se eliminan los certificados."
}
],
"lastModified": "2026-06-17T09:22:54.780",
"sourceIdentifier": "info@cert.vde.com"
}