VulnerabilityDeferred

CVE-2025-41659

A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys.

HIGH 8.3EPSS 0.21%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.

CVSS 3.1: 8.3 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS: 0.21% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-732
Source: info@cert.vde.com

References

https://certvde.com/de/advisories/VDE-2025-051

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.