Codesys Runtime Toolkit vulnerabilities

29 CVEs affecting Codesys Runtime Toolkit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-76992, published 2026-09-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-30186, published 2021-05-25. High severity, CVSS 7.5. EPSS: 7.4% chance of exploitation in the next 30 days. CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
CVE-2021-30195, published 2021-05-25. High severity, CVSS 7.5. EPSS: 7.2% chance of exploitation in the next 30 days. CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
CVE-2021-34593, published 2021-10-26. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs…
CVE-2022-32137, published 2022-06-24. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User…
CVE-2019-19789, published 2019-12-20. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. 3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference.
CVE-2022-31806, published 2022-06-24. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login…
CVE-2022-32143, published 2022-06-24. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller…
CVE-2022-32138, published 2022-06-24. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite.
CVE-2022-32142, published 2022-06-24. High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days. Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write…
CVE-2022-1965, published 2022-06-24. High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days. Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file…

Latest

CVE-2026-76992, published 2026-09-30. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious…
CVE-2026-79625, published 2026-09-30. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of…
CVE-2025-41738, published 2025-12-01. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a…
CVE-2025-41659, published 2025-08-04. High severity, CVSS 8.3. EPSS: 0.2% chance of exploitation in the next 30 days. A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to…
CVE-2025-41658, published 2025-08-04. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
CVE-2024-8175, published 2024-09-25. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.
CVE-2024-5000, published 2024-06-04. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.
CVE-2023-6357, published 2023-12-05. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.
CVE-2022-4224, published 2023-03-23. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.