Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-26 | 1 | General1 |
| 2026-05-01 | 1 | Disclosure1 |
Backdooring CODESYS Applications via Vulnerability Chaining #PLC CVE-2025-41658 + CVE-2025-41659 + CVE-2025-41660 https://www.nozominetworks.com/blog/backdooring-codesys-applications-via-vulnerability-chaining https://t.co/4OJyigA3VG
Post summary
The tweet announces a blog post about backdooring CODESYS applications via vulnerability chaining, but provides no explicit PoC, exploit details, patches, or technical specifics.
Nozomi researchers chain CVE-2025-41658, CVE-2025-41659, and CVE-2025-41660 in CODESYS Control runtime, allowing authenticated attackers to inject malicious code and achieve root-level control of PLCs across manufacturing, energy, and water sec... #DFIR_Radar https://t.co/45GfiHZygt
Post summary
Nozomi researchers disclosed three chained vulnerabilities (CVE‑2025‑41658, CVE‑2025‑41659, CVE‑2025‑41660) in CODESYS Control runtime that allow authenticated attackers to inject malicious code and gain root-level control of PLCs across industrial sectors.