CVE-2021-36763

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-03 · updated 2026-06-17
Weakness: CWE-552

Description

In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.

Affected products

CODESYS Control: before 4.2.0.0; through 4.2.0.0 — fixed in 4.2.0.0
CODESYS Control Rte: before 3.5.17.10 — fixed in 3.5.17.10
CODESYS Control Runtime System Toolkit: before 3.5.17.10 — fixed in 3.5.17.10
CODESYS Control Win (SL): before 3.5.17.10 — fixed in 3.5.17.10
CODESYS Embedded Target Visu Toolkit: before 3.5.17.10 — fixed in 3.5.17.10
CODESYS Hmi: before 3.5.17.10 — fixed in 3.5.17.10
CODESYS Remote Target Visu Toolkit: before 3.5.17.10 — fixed in 3.5.17.10

How to fix

Upgrade to a fixed version: CODESYS Control 4.2.0.0; CODESYS Control Rte 3.5.17.10; CODESYS Control Runtime System Toolkit 3.5.17.10; CODESYS Control Win (SL) 3.5.17.10; CODESYS Embedded Target Visu Toolkit 3.5.17.10; CODESYS Hmi 3.5.17.10; CODESYS Remote Target Visu Toolkit 3.5.17.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-36763 or the next vulnerability affects your stack