CVE-2026-3509

Estado: Pendiente de análisisAlta (7.5)—

An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.57%
Percentil entre todas las CVEs puntuadas: 45
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1499.004 Application or System Exploitationimpact90 %

Vector AV:N/PR:N/UI:N indica explotación remota sin privilegios (T1190). CWE-134 (format string) en Audit Log permite controlar formato de mensajes causando DoS (T1499.004, variante aplicación).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Application Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Codesys — Control^AI

CWE

CWE-134

Referencias

https://certvde.com/de/advisories/VDE-2026-018

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-3509",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-3509",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-26T12:35:33.893071Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control RTE (SL)",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.17.0",
              "lessThan": "3.5.22.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control RTE (for Beckhoff CX) SL",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.17.0",
              "lessThan": "3.5.22.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control Win (SL)",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.17.0",
              "lessThan": "3.5.22.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Runtime Toolkit",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.17.0",
              "lessThan": "3.5.22.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for BeagleBone SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for emPC-A/iMX6 SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for IOT2000 SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for Linux ARM SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for Linux SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for PFC100 SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for PFC200 SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for PLCnext SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for Raspberry Pi SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for WAGO Touch Panels 600 SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Virtual Control SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-24T08:16:01.657",
  "references": [
    {
      "url": "https://certvde.com/de/advisories/VDE-2026-018",
      "source": "info@cert.vde.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition."
    },
    {
      "lang": "es",
      "value": "Un atacante remoto no autenticado podría controlar la cadena de formato de los mensajes procesados por el Registro de Auditoría del sistema de tiempo de ejecución CODESYS Control, resultando potencialmente en una condición de denegación de servicio (DoS)."
    }
  ],
  "lastModified": "2026-06-17T10:43:41.653",
  "sourceIdentifier": "info@cert.vde.com"
}