Riskcovery

CVE-2026-3509

CODESYS Control Audit Log Format String DoS

State
Published
Severity
7.5 High
Published
Mar 24, 2026
Updated
Mar 26, 2026
Reserved
Mar 4, 2026

Read the record on cve.org

Description

An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCERTVDE

Weaknesses

  • CWE-134 Use of Externally-Controlled Format String

Affected Products

ProductVersions
CODESYS Control RTE (SL)CODESYS
  • 3.5.17.0 to before 3.5.22.0Affected
CODESYS Control RTE (for Beckhoff CX) SLCODESYS
  • 3.5.17.0 to before 3.5.22.0Affected
CODESYS Control Win (SL)CODESYS
  • 3.5.17.0 to before 3.5.22.0Affected
CODESYS Runtime ToolkitCODESYS
  • 3.5.17.0 to before 3.5.22.0Affected
CODESYS Control for BeagleBone SLCODESYS
  • 4.1.0.0 to before 4.21.0.0Affected
CODESYS Control for emPC-A/iMX6 SLCODESYS
  • 4.1.0.0 to before 4.21.0.0Affected
CODESYS Control for IOT2000 SLCODESYS
  • 4.1.0.0 to before 4.21.0.0Affected
CODESYS Control for Linux ARM SLCODESYS
  • 4.1.0.0 to before 4.21.0.0Affected
CODESYS Control for Linux SLCODESYS
  • 4.1.0.0 to before 4.21.0.0Affected
CODESYS Control for PFC100 SLCODESYS
  • 4.1.0.0 to before 4.21.0.0Affected
CODESYS Control for PFC200 SLCODESYS
  • 4.1.0.0 to before 4.21.0.0Affected
CODESYS Control for PLCnext SLCODESYS
  • 4.1.0.0 to before 4.21.0.0Affected
CODESYS Control for Raspberry Pi SLCODESYS
  • 4.1.0.0 to before 4.21.0.0Affected
CODESYS Control for WAGO Touch Panels 600 SLCODESYS
  • 4.1.0.0 to before 4.21.0.0Affected
CODESYS Virtual Control SLCODESYS
  • 4.1.0.0 to before 4.21.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.