CVE-2025-41691 - Vulnerability Details - OpenCVE

An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Codesys	Control

No data.

No data.

References

Link	Providers
https://certvde.com/de/advisories/VDE-2025-070

History

Tue, 05 Aug 2025 11:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Codesys Codesys control
Vendors & Products		Codesys Codesys control

Mon, 04 Aug 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 04 Aug 2025 08:15:00 +0000

Type	Values Removed	Values Added
Description		An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.
Title		CODESYS Control DoS via Unauthenticated NULL Pointer Dereference
Weaknesses		CWE-476
References		https://certvde.com/de/advisories/VDE-2025-070
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2025-08-04T08:04:34.981Z

Updated: 2025-08-04T16:32:30.773Z

Reserved: 2025-04-16T11:17:48.309Z

Link: CVE-2025-41691

Vulnrichment

Updated: 2025-08-04T16:29:30.560Z

NVD

Status : Awaiting Analysis

Published: 2025-08-04T08:15:48.353

Modified: 2025-08-04T15:06:15.833

Link: CVE-2025-41691

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-41691", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2025-04-16T11:17:48.309Z", "datePublished": "2025-08-04T08:04:34.981Z", "dateUpdated": "2025-08-04T16:32:30.773Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Control RTE (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control RTE (for Beckhoff CX) SL", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control Win (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "HMI (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.21.20", "status": "affected", "version": "3.5.21.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for BeagleBone SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for emPC-A/iMX6 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for IOT2000 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for Linux ARM SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for Linux SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for PFC100 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for PFC200 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for PLCnext SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for Raspberry Pi SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Control for WAGO Touch Panels 600 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Virtual Control SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.17.0.0", "status": "affected", "version": "4.16.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.<br>"}], "value": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-08-04T08:04:34.981Z"}, "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-070"}], "source": {"advisory": "VDE-2025-070", "defect": ["CERT@VDE#641834"], "discovery": "UNKNOWN"}, "title": "CODESYS Control DoS via Unauthenticated NULL Pointer Dereference", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-04T16:28:09.392670Z", "id": "CVE-2025-41691", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T16:32:30.773Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41691", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-04T16:28:09.392670Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T16:29:30.560Z"}}], "cna": {"title": "CODESYS Control DoS via Unauthenticated NULL Pointer Dereference", "source": {"defect": ["CERT@VDE#641834"], "advisory": "VDE-2025-070", "discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CODESYS", "product": "Control RTE (SL)", "versions": [{"status": "affected", "version": "3.5.21.10", "lessThan": "3.5.21.20", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control RTE (for Beckhoff CX) SL", "versions": [{"status": "affected", "version": "3.5.21.10", "lessThan": "3.5.21.20", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control Win (SL)", "versions": [{"status": "affected", "version": "3.5.21.10", "lessThan": "3.5.21.20", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "HMI (SL)", "versions": [{"status": "affected", "version": "3.5.21.10", "lessThan": "3.5.21.20", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for BeagleBone SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for emPC-A/iMX6 SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for IOT2000 SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for Linux ARM SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for Linux SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for PFC100 SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for PFC200 SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for PLCnext SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for Raspberry Pi SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for WAGO Touch Panels 600 SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Virtual Control SL", "versions": [{"status": "affected", "version": "4.16.0.0", "lessThan": "4.17.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-070"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.", "supportingMedia": [{"type": "text/html", "value": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-08-04T08:04:34.981Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41691", "state": "PUBLISHED", "dateUpdated": "2025-08-04T16:32:30.773Z", "dateReserved": "2025-04-16T11:17:48.309Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2025-08-04T08:04:34.981Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}