Codesys Plchandler vulnerabilities

4 CVEs affecting Codesys Plchandler, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-76992, published 2026-09-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-20026, published 2019-02-19. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0.
CVE-2021-29242, published 2021-05-03. High severity, CVSS 7.3. EPSS: 1.1% chance of exploitation in the next 30 days. CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove…
CVE-2022-31805, published 2022-06-24. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
CVE-2026-76992, published 2026-09-30. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious…