CVE-2019-19789

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-20 · updated 2026-06-17
Weakness: CWE-476

Description

3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference.

Affected products

CODESYS PLCWinNT: before 2.4.7.54 — fixed in 2.4.7.54
CODESYS Runtime Toolkit: before 2.4.7.54 — fixed in 2.4.7.54
CODESYS Sp Realtime Nt: before 2.3.7.28 — fixed in 2.3.7.28

How to fix

Upgrade to a fixed version: CODESYS PLCWinNT 2.4.7.54; CODESYS Runtime Toolkit 2.4.7.54; CODESYS Sp Realtime Nt 2.3.7.28. Check the vendor advisory for mitigations.

References

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12946&token=edd5d8e821edaf3189d36bb1cac1aa1bfc42351f&download=
https://www.codesys.com
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12946&token=edd5d8e821edaf3189d36bb1cac1aa1bfc42351f&download=
https://www.codesys.com

Get alerted when CVE-2019-19789 or the next vulnerability affects your stack