Codesys HMI Sl vulnerabilities

6 CVEs affecting Codesys HMI Sl, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-8047, published 2026-05-26.

More from Codesys.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-8175, published 2024-09-25. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.
• CVE-2026-8047, published 2026-05-26. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw…
• CVE-2024-5000, published 2024-06-04. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.
• CVE-2026-8046, published 2026-05-26. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including…
• CVE-2025-41660, published 2026-03-24. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.
• CVE-2023-5751, published 2024-06-04. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A local attacker with low privileges can read and modify any users files and cause a DoS in the working directory of the affected products due to exposure of resource to wrong sphere.