CVE-2025-41738: Codesys Control For Beaglebone Sl

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.

Affected products

• Codesys Control For Beaglebone Sl: from 4.5.0.0, before 4.19.0.0 (fixed in 4.19.0.0)
• Codesys Control For Empc-a/imx6 Sl: from 4.5.0.0, up to and including 4.19.0.0
• Codesys Control For IOT2000 Sl: from 4.5.0.0, before 4.19.0.0 (fixed in 4.19.0.0)
• Codesys Control For Linux Arm Sl: from 4.5.0.0, before 4.19.0.0 (fixed in 4.19.0.0)
• Codesys Control For Linux Sl: from 4.5.0.0, before 4.19.0.0 (fixed in 4.19.0.0)
• Codesys Control For PFC100 Sl: from 4.5.0.0, up to and including 4.19.0.0
• Codesys Control For PFC200 Sl: from 4.5.0.0, before 4.19.0.0 (fixed in 4.19.0.0)
• Codesys Control For Plcnext Sl: from 4.5.0.0, before 4.19.0.0 (fixed in 4.19.0.0)
• Codesys Control For Raspberry Pi Sl: from 4.5.0.0, before 4.19.0.0 (fixed in 4.19.0.0)
• Codesys Control For Wago Touch Panels 600 Sl: from 4.5.0.0, up to and including 4.19.0.0
• Codesys Control Rte Sl: from 3.5.18.0, before 3.5.21.40 (fixed in 3.5.21.40)
• Codesys Control Rte Sl (for Beckhoff Cx): from 3.5.18.0, before 3.5.21.40 (fixed in 3.5.21.40)
• Codesys Control Win Sl: from 3.5.18.0, before 3.5.21.40 (fixed in 3.5.21.40)
• Codesys HMI Sl: from 3.5.18.0, before 3.5.21.40 (fixed in 3.5.21.40)
• Codesys Remote Target Visu: from 3.5.18.0, before 3.5.21.40 (fixed in 3.5.21.40)
• Codesys Runtime Toolkit: from 3.5.18.0, before 3.5.21.40 (fixed in 3.5.21.40)
• Codesys Virtual Control Sl: from 4.5.0.0, before 4.19.0.0 (fixed in 4.19.0.0)

Published 2025-12-01. Last modified 2026-06-17.