CVE-2025-41660: CODESYS Control Runtime RCE Vulnerability

CVE-2025-41660 Overview

CVE-2025-41660 is a high-severity vulnerability affecting the CODESYS Control runtime system that allows a low-privileged remote attacker to replace the boot application, enabling unauthorized code execution. This vulnerability represents a significant threat to industrial control systems (ICS) and operational technology (OT) environments where CODESYS runtime is deployed.

The vulnerability stems from improper resource transfer controls (CWE-669), which allows authenticated attackers with minimal privileges to modify critical boot components of the runtime system. Successful exploitation could result in complete compromise of the affected system, potentially impacting industrial processes and safety-critical operations.

Critical Impact

A low-privileged remote attacker can replace the boot application of CODESYS Control runtime systems, leading to unauthorized code execution with potential for full system compromise in industrial environments.

Affected Products

• CODESYS Control runtime system (specific versions not disclosed in advisory)

Discovery Timeline

• 2026-03-24 - CVE CVE-2025-41660 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2025-41660

Vulnerability Analysis

This vulnerability is classified under CWE-669: Incorrect Resource Transfer Between Spheres, which indicates a fundamental flaw in how the CODESYS Control runtime handles resource boundaries and access controls. The vulnerability allows authenticated users with low-level privileges to perform operations that should be restricted to administrative or highly privileged accounts.

In CODESYS Control environments, the boot application is a critical component that initializes the runtime system and loads the programmable logic controller (PLC) application. The ability to replace this component represents a serious security boundary violation, as it enables attackers to inject malicious code that executes during the system initialization process.

The network-accessible nature of this vulnerability significantly increases its risk profile, as attackers can exploit it remotely without requiring physical access to the target system. Once a low-privileged session is established, the attacker can leverage insufficient access controls to overwrite the boot application with a malicious payload.

Root Cause

The root cause of CVE-2025-41660 lies in improper access control validation within the CODESYS Control runtime's resource management subsystem. The system fails to adequately verify that users requesting boot application modifications possess the necessary privilege level, allowing low-privileged accounts to perform operations reserved for administrators.

This represents a classic case of broken access control where the authorization layer does not properly enforce the principle of least privilege. The transfer of the boot application resource crosses a security boundary without appropriate validation, enabling privilege escalation through boot application replacement.

Attack Vector

The attack vector for CVE-2025-41660 is network-based, requiring only low-level authentication credentials to exploit. An attacker would:

1. Establish a network connection to the target CODESYS Control runtime
2. Authenticate using valid but low-privileged credentials
3. Submit a request to replace the boot application
4. Upload a malicious boot application payload
5. Wait for or trigger a system restart to execute the malicious code

The exploitation does not require user interaction and can be performed with low complexity. The attacker needs valid credentials (even minimal privileges) but does not require administrative access, making this vulnerability particularly dangerous in environments where multiple user accounts exist with varying privilege levels.

For technical details on the vulnerability and exploitation mechanisms, refer to the CERT-VDE Advisory VDE-2026-011.

Detection Methods for CVE-2025-41660

Indicators of Compromise

• Unexpected modifications to boot application files or configurations on CODESYS Control systems
• Authentication events followed by boot application replacement requests from low-privileged accounts
• Unusual network traffic patterns to CODESYS Control runtime ports
• System restarts or boot sequence anomalies in ICS/OT environments

Detection Strategies

• Implement file integrity monitoring (FIM) on CODESYS Control boot application directories and critical configuration files
• Configure SIEM rules to correlate authentication events with subsequent privileged operations on CODESYS systems
• Deploy network detection signatures to identify boot application replacement protocol sequences
• Enable comprehensive audit logging for all CODESYS Control runtime operations

Monitoring Recommendations

• Establish baseline behavior for boot application access patterns and alert on deviations
• Monitor for privilege escalation attempts and unauthorized resource access within CODESYS environments
• Implement continuous monitoring of ICS/OT network segments for anomalous CODESYS protocol traffic
• Review authentication logs regularly for evidence of credential misuse targeting CODESYS systems

How to Mitigate CVE-2025-41660

Immediate Actions Required

• Review and restrict network access to CODESYS Control runtime systems using network segmentation and firewall rules
• Audit all user accounts with access to CODESYS Control systems and implement strict least-privilege access controls
• Monitor for any suspicious activity targeting boot application components
• Consider isolating affected systems from untrusted networks until patches are available

Patch Information

Organizations should consult the CERT-VDE Advisory VDE-2026-011 for official patch information and remediation guidance from the vendor. Apply vendor-supplied security updates as they become available, following proper change management procedures for ICS/OT environments.

Workarounds

• Implement network segmentation to restrict access to CODESYS Control systems from untrusted networks
• Enforce strong authentication mechanisms and consider implementing multi-factor authentication where supported
• Disable or remove unnecessary low-privileged user accounts that have access to CODESYS runtime systems
• Deploy application-level firewalls or protocol inspection to filter malicious requests targeting boot application functionality