{"id":"CVE-2025-41659","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-41659","generatedAt":"2026-10-28T10:47:18.913Z","title":"A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys.","description":"A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.","published":"2025-08-04T08:15:48.000Z","lastModified":"2026-06-17T09:22:55.000Z","status":"Deferred","sourceIdentifier":"info@cert.vde.com","cvss":{"version":"3.1","score":8.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"},"cwe":["CWE-732"],"affected":[],"epss":{"score":0.00241,"percentile":0.15128,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://certvde.com/de/advisories/VDE-2025-051","source":"info@cert.vde.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-41659","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}