CVE-2026-79625

Summary

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.

Affected Software

VendorProductVersion RangeStatus
CODESYSControl RTE (SL)3.0.0.0 < 3.5.22.40affected
CODESYSControl RTE (for Beckhoff CX) SL3.0.0.0 < 3.5.22.40affected
CODESYSControl Win (SL)3.0.0.0 < 3.5.22.40affected
CODESYSRuntime Toolkit3.0.0.0 < 3.5.22.40affected
CODESYSSafety SIL23.0.0.0 < 3.5.22.40affected
CODESYSHMI (SL)3.0.0.0 < 3.5.22.40affected
CODESYSDevelopment System 33.0.0.0 < 3.5.22.40affected
CODESYSControl for BeagleBone SL3.5.0.0 < 4.23.0.0affected
CODESYSControl for emPC-A/iMX6 SL3.5.0.0 < 4.23.0.0affected
CODESYSControl for IOT2000 SL3.5.0.0 < 4.23.0.0affected
CODESYSControl for Linux ARM SL3.5.0.0 < 4.23.0.0affected
CODESYSControl for Linux SL3.5.0.0 < 4.23.0.0affected
CODESYSControl for PFC100 SL3.5.0.0 < 4.23.0.0affected
CODESYSControl for PFC200 SL3.5.0.0 < 4.23.0.0affected
CODESYSControl for PLCnext SL3.5.0.0 < 4.23.0.0affected
CODESYSControl for Raspberry Pi SL3.5.0.0 < 4.23.0.0affected
CODESYSControl for WAGO Touch Panels 600 SL3.5.0.0 < 4.23.0.0affected
CODESYSVirtual Control SL3.5.0.0 < 4.23.0.0affected

Weaknesses

  • CWE-362: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References