CVE-2021-33485

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-03 · updated 2026-06-17
Weakness: CWE-787

Description

CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.

Affected products

CODESYS Control: before 4.2.0.0; through 4.2.0.0 — fixed in 4.2.0.0
CODESYS Control Rte: before 3.5.17.10 — fixed in 3.5.17.10
CODESYS Control Runtime System Toolkit: before 3.5.17.10 — fixed in 3.5.17.10
CODESYS Control Win (SL): before 3.5.17.10 — fixed in 3.5.17.10
CODESYS Embedded Target Visu Toolkit: before 3.5.17.10 — fixed in 3.5.17.10
CODESYS Hmi: before 3.5.17.10 — fixed in 3.5.17.10
CODESYS Remote Target Visu Toolkit: before 3.5.17.10 — fixed in 3.5.17.10

How to fix

Upgrade to a fixed version: CODESYS Control 4.2.0.0; CODESYS Control Rte 3.5.17.10; CODESYS Control Runtime System Toolkit 3.5.17.10; CODESYS Control Win (SL) 3.5.17.10; CODESYS Embedded Target Visu Toolkit 3.5.17.10; CODESYS Hmi 3.5.17.10; CODESYS Remote Target Visu Toolkit 3.5.17.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-33485 or the next vulnerability affects your stack