CVE-2025-41660Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://certvde.com/de/advisories/VDE-2026-011

Weakness type (CWE)

CWE-669

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

6 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
General: 2 classified signals
Peaked 2d ago at 4 mentions (2026-03-24); latest day: 1
6 total mentions across 3 days

Deep dive

Activity timeline6 mentions / 3d

Signal classification2 categories

Disclosure

466.7%

General

233.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-24	4	Disclosure3General1
2026-04-26	1	General1
2026-05-01	1	Disclosure1

Full discourse6 posts

blackorbird@blackorbird166d
General
Backdooring CODESYS Applications via Vulnerability Chaining #PLC CVE-2025-41658 + CVE-2025-41659 + CVE-2025-41660 https://www.nozominetworks.com/blog/backdooring-codesys-applications-via-vulnerability-chaining https://t.co/4OJyigA3VG
Post summary
The tweet promotes a blog post about backdooring CODESYS applications via vulnerability chaining for CVE‑2025‑41658, ‑41659, and ‑41660, but does not provide specific technical details, PoC, or evidence of exploitation.
19136155.2K
42.7K followersView on X
DFIR Radar@DFIR_Radar162d
Disclosure
Nozomi researchers chain CVE-2025-41658, CVE-2025-41659, and CVE-2025-41660 in CODESYS Control runtime, allowing authenticated attackers to inject malicious code and achieve root-level control of PLCs across manufacturing, energy, and water sec... #DFIR_Radar https://t.co/45GfiHZygt
Post summary
Researchers have identified a chain of CVEs (CVE-2025-41658, CVE-2025-41659, CVE-2025-41660) in CODESYS Control runtime that enable authenticated attackers to inject code and gain root-level control of PLCs across various industrial sectors.
100101.0K
1.7K followersView on X
RedPacket Security@RedPacketSec199d
General
CVE Alert: CVE-2025-41660 - CODESYS - CODESYS Control RTE (SL) - https://www.redpacketsecurity.com/cve-alert-cve-2025-41660-codesys-codesys-control-rte-sl/ #OSINT #ThreatIntel #CyberSecurity #cve-2025-41660 #codesys #codesys-control-rte-sl
Post summary
The post is a brief CVE alert with a link to an external resource but provides no technical or actionable details.
00000278
3.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds200d
Disclosure
CVE-2025-41660 CODESYS Control Runtime System Remote Code Execution via Boot Application Replacement https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-41660
Post summary
CVE-2025-41660 is a Remote Code Execution vulnerability in the CODESYS Control Runtime System caused by boot application replacement. No PoC, exploit, patch, or active exploitation evidence has been reported.
0000092
4.0K followersView on X
CVE@CVEnew200d
Disclosure
CVE-2025-41660 A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution. https://www.cve.org/CVERecord?id=CVE-2025-41660
Post summary
The post announces CVE‑2025‑41660, noting that a low‑privileged remote attacker could replace the boot application in the CODESYS Control runtime to execute unauthorized code.
00000115
56.8K followersView on X
CVEFind.com@CveFindCom200d
Disclosure
[CVE-2025-41660: HIGH] A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.#cve,CVE-2025-41660,#cybersecurity https://cvefind.com/CVE-2025-41660
Post summary
The tweet announces CVE‑2025‑41660, describing a high‑severity flaw that allows a low‑privileged remote attacker to replace the boot application and execute unauthorized code on the CODESYS Control runtime system, without providing PoC, exploit, or patch details.
0000091
606 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2025-41660

blackorbird[verified]@blackorbirdGeneral

The tweet promotes a blog post about backdooring CODESYS applications via vulnerability chaining for CVE‑2025‑41658, ‑41659, and ‑41660, but does not provide specific technical details, PoC, or evidence of exploitation.

DFIR Radar[verified]@DFIR_RadarDisclosure

Researchers have identified a chain of CVEs (CVE-2025-41658, CVE-2025-41659, CVE-2025-41660) in CODESYS Control runtime that enable authenticated attackers to inject code and gain root-level control of PLCs across various industrial sectors.

RedPacket Security@RedPacketSecGeneral

The post is a brief CVE alert with a link to an external resource but provides no technical or actionable details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

CVE-2025-41660 is a Remote Code Execution vulnerability in the CODESYS Control Runtime System caused by boot application replacement. No PoC, exploit, patch, or active exploitation evidence has been reported.

CVE@CVEnewDisclosure

The post announces CVE‑2025‑41660, noting that a low‑privileged remote attacker could replace the boot application in the CODESYS Control runtime to execute unauthorized code.

CVEFind.com@CveFindComDisclosure

The tweet announces CVE‑2025‑41660, describing a high‑severity flaw that allows a low‑privileged remote attacker to replace the boot application and execute unauthorized code on the CODESYS Control runtime system, without providing PoC, exploit, or patch details.