CVE-2025-41691
Estado: AplazadaAlta (7.5)—
An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.55%
- Percentil entre todas las CVEs puntuadas: 44
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access95 % - Impacto principal
T1499.004Application or System Exploitationimpact90 %
AV:N/AC:L/PR:N sin UI indica explotación remota sin autenticación (T1190). NULL pointer dereference causa crash → DoS aplicación (T1499.004).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-476
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-41691",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-41691",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-08-04T16:28:09.392670Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "info@cert.vde.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "info@cert.vde.com",
"affectedData": [
{
"vendor": "CODESYS",
"product": "Control RTE (SL)",
"versions": [
{
"status": "affected",
"version": "3.5.21.10",
"lessThan": "3.5.21.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control RTE (for Beckhoff CX) SL",
"versions": [
{
"status": "affected",
"version": "3.5.21.10",
"lessThan": "3.5.21.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control Win (SL)",
"versions": [
{
"status": "affected",
"version": "3.5.21.10",
"lessThan": "3.5.21.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "HMI (SL)",
"versions": [
{
"status": "affected",
"version": "3.5.21.10",
"lessThan": "3.5.21.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for BeagleBone SL",
"versions": [
{
"status": "affected",
"version": "4.16.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for emPC-A/iMX6 SL",
"versions": [
{
"status": "affected",
"version": "4.16.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for IOT2000 SL",
"versions": [
{
"status": "affected",
"version": "4.16.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for Linux ARM SL",
"versions": [
{
"status": "affected",
"version": "4.16.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for Linux SL",
"versions": [
{
"status": "affected",
"version": "4.16.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for PFC100 SL",
"versions": [
{
"status": "affected",
"version": "4.16.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for PFC200 SL",
"versions": [
{
"status": "affected",
"version": "4.16.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for PLCnext SL",
"versions": [
{
"status": "affected",
"version": "4.16.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for Raspberry Pi SL",
"versions": [
{
"status": "affected",
"version": "4.16.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Control for WAGO Touch Panels 600 SL",
"versions": [
{
"status": "affected",
"version": "4.16.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "Virtual Control SL",
"versions": [
{
"status": "affected",
"version": "4.16.0.0",
"lessThan": "4.17.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2025-08-04T08:15:48.353",
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-070",
"source": "info@cert.vde.com"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "info@cert.vde.com",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition."
},
{
"lang": "es",
"value": "Un atacante remoto no autenticado puede provocar una desreferencia de puntero NULL en los sistemas de ejecución de CODESYS Control afectados mediante el envío de solicitudes de comunicación especialmente manipuladas, lo que podría conducir a una condición de denegación de servicio (DoS)."
}
],
"lastModified": "2026-06-17T09:22:58.030",
"sourceIdentifier": "info@cert.vde.com"
}