Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
Backdooring CODESYS Applications via Vulnerability Chaining #PLC CVE-2025-41658 + CVE-2025-41659 + CVE-2025-41660 https://www.nozominetworks.com/blog/backdooring-codesys-applications-via-vulnerability-chaining https://t.co/4OJyigA3VG
Post summary
A blog post announces three new CVEs (CVE-2025-41658, CVE-2025-41659, CVE-2025-41660) that enable backdooring CODESYS applications through vulnerability chaining.
Nozomi researchers chain CVE-2025-41658, CVE-2025-41659, and CVE-2025-41660 in CODESYS Control runtime, allowing authenticated attackers to inject malicious code and achieve root-level control of PLCs across manufacturing, energy, and water sec... #DFIR_Radar https://t.co/45GfiHZygt
Post summary
Nozomi researchers disclosed a chain of CVEs in CODESYS Control runtime that enable authenticated attackers to inject code and gain root-level control of PLCs across manufacturing, energy, and water sectors.