CVE-2025-41659 Overview
CVE-2025-41659 affects the CODESYS Control runtime system. A low-privileged remote attacker can access the Public Key Infrastructure (PKI) folder used by the runtime. This access permits reading and writing of certificates and their associated private keys.
The vulnerability maps to [CWE-732] Incorrect Permission Assignment for Critical Resource. Attackers can extract sensitive cryptographic material or plant trusted certificates. Deleting certificates does not stop services, but forces communication to fall back to unencrypted channels. This exposes industrial control traffic to interception and tampering.
Critical Impact
Remote authenticated attackers can steal private keys, forge trusted certificates, and downgrade industrial communications to cleartext.
Affected Products
- CODESYS Control runtime system
- Industrial controllers and PLCs running CODESYS Control
- Engineering and HMI components communicating with the runtime over the affected PKI store
Discovery Timeline
- 2025-08-04 - CVE-2025-41659 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-41659
Vulnerability Analysis
The CODESYS Control runtime stores X.509 certificates and private keys in a PKI folder used to secure communication between engineering tools, HMIs, and the controller. Access control on this folder fails to restrict low-privileged remote accounts from reading or writing its contents.
An authenticated attacker with minimal privileges can list certificates, exfiltrate the corresponding private keys, and overwrite or add certificate entries. Stealing a private key permits impersonation of the controller in TLS sessions. Writing attacker-controlled certificates causes the runtime to trust hostile peers in subsequent connections.
The attack delivers high confidentiality and integrity impact. Availability impact is limited because services continue to run after certificate manipulation. However, removing certificates strips transport encryption, causing the runtime to fall back to unencrypted protocols and exposing engineering sessions to passive capture and active modification.
Root Cause
The runtime grants read and write access to the PKI directory without enforcing the principle of least privilege. Low-privileged user roles inherit permissions that should be restricted to administrators or the runtime service account. The flaw is a configuration and access-control design issue rather than a memory-safety defect.
Attack Vector
Exploitation requires network reachability to the CODESYS Control runtime and a valid low-privileged account. The attacker authenticates, requests PKI folder operations through the runtime's management interface, and reads or writes certificate files. No user interaction is required. The vulnerability mechanism is documented in the CERT VDE Security Advisory.
Detection Methods for CVE-2025-41659
Indicators of Compromise
- Unexpected read or write operations against the CODESYS PKI directory by non-administrative user accounts
- New, modified, or deleted certificate files in the runtime PKI store outside change windows
- TLS sessions to the controller suddenly downgraded to unencrypted protocols
- Authentication events from low-privileged accounts followed by certificate management API calls
Detection Strategies
- Enable runtime audit logging for all PKI folder access and ship logs to a central SIEM for correlation
- Baseline expected certificate inventory on each controller and alert on hash or fingerprint changes
- Monitor network traffic to controllers for protocol downgrades from TLS to cleartext variants
- Correlate low-privileged session activity with certificate read, write, or delete operations
Monitoring Recommendations
- Track all authentication events to CODESYS Control runtimes and flag non-administrative accounts that touch PKI resources
- Alert on any modification to private key files on controllers regardless of source account
- Periodically reconcile deployed certificate fingerprints against a known-good inventory
How to Mitigate CVE-2025-41659
Immediate Actions Required
- Apply the vendor-supplied update referenced in the CERT VDE Security Advisory VDE-2025-051
- Restrict network access to CODESYS Control runtime ports to engineering workstations and trusted management hosts only
- Audit and remove unnecessary low-privileged accounts on each affected controller
- Rotate all certificates and private keys stored on controllers that were reachable by untrusted accounts
Patch Information
CODESYS publishes fixed runtime versions through CERT@VDE. Refer to the CERT VDE Security Advisory for affected version ranges and patched releases. Apply the patched runtime to every controller and any engineering host that embeds the runtime.
Workarounds
- Place affected controllers behind a segmented operational technology network and block direct access from enterprise or remote networks
- Disable or remove low-privileged user accounts that do not require runtime access
- Enforce strong, unique passwords on all runtime accounts and require multi-factor authentication on jump hosts that reach the controller
- Monitor controller PKI folders for unauthorized changes until patches are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
