What’s Vulnerable › Vulnerabilities

CVE-2023-3670: Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-28 · updated 2026-06-17
• Weakness: CWE-668

Description

In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.

Affected products

• CODESYS Development System: from 3.5.9.0 before 3.5.17.0 — fixed in 3.5.17.0
• CODESYS Scripting: from 4.0.0.0 before 4.1.0.0 — fixed in 4.1.0.0

How to fix

Upgrade to a fixed version: CODESYS Development System 3.5.17.0; CODESYS Scripting 4.1.0.0. Check the vendor advisory for mitigations.

References

• https://cert.vde.com/en/advisories/VDE-2023-024
• https://cert.vde.com/en/advisories/VDE-2023-024

Get alerted when CVE-2023-3670 or the next vulnerability affects your stack