CVE-2026-8047 (GCVE-0-2026-8047)
Vulnerability from cvelistv5 – Published: 2026-05-26 06:49 – Updated: 2026-05-26 10:48
VLAI
EPSS
VEX
Title
Out-of-bounds Write in CODESYS Control
Summary
The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
1 reference
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| CODESYS | CODESYS Control RTE (SL) |
Affected:
3.5.21.0 , < 3.5.22.20
(semver)
|
|
| CODESYS | CODESYS Control RTE (for Beckhoff CX) SL |
Affected:
3.5.21.0 , < 3.5.22.20
(semver)
|
|
| CODESYS | CODESYS Control Win (SL) |
Affected:
3.5.21.0 , < 3.5.22.20
(semver)
|
|
| CODESYS | CODESYS HMI (SL) |
Affected:
3.5.21.0 , < 3.5.22.20
(semver)
|
|
| CODESYS | CODESYS Runtime Toolkit |
Affected:
3.5.21.0 , < 3.5.22.20
(semver)
|
|
| CODESYS | CODESYS Control for BeagleBone SL |
Affected:
4.15.0.0 , < 4.21.0.0
(semver)
|
|
| CODESYS | CODESYS Control for emPC-A/iMX6 SL |
Affected:
4.15.0.0 , < 4.21.0.0
(semver)
|
|
| CODESYS | CODESYS Control for IOT2000 SL |
Affected:
4.15.0.0 , < 4.21.0.0
(semver)
|
|
| CODESYS | CODESYS Control for Linux ARM SL |
Affected:
4.15.0.0 , < 4.21.0.0
(semver)
|
|
| CODESYS | CODESYS Control for Linux SL |
Affected:
4.15.0.0 , < 4.21.0.0
(semver)
|
|
| CODESYS | CODESYS Control for PFC100 SL |
Affected:
4.15.0.0 , < 4.21.0.0
(semver)
|
|
| CODESYS | CODESYS Control for PFC200 SL |
Affected:
4.15.0.0 , < 4.21.0.0
(semver)
|
|
| CODESYS | CODESYS Control for PLCnext SL |
Affected:
4.15.0.0 , < 4.21.0.0
(semver)
|
|
| CODESYS | CODESYS Control for Raspberry Pi SL |
Affected:
4.15.0.0 , < 4.21.0.0
(semver)
|
|
| CODESYS | CODESYS Control for WAGO Touch Panels 600 SL |
Affected:
0.0.0 , < 4.21.0.0
(semver)
|
|
| CODESYS | CODESYS Virtual Control SL |
Affected:
4.15.0.0 , < 4.21.0.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8047",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T10:45:06.909963Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T10:48:24.087Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CODESYS Control RTE (SL)",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "3.5.22.20",
"status": "affected",
"version": "3.5.21.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control RTE (for Beckhoff CX) SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "3.5.22.20",
"status": "affected",
"version": "3.5.21.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control Win (SL)",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "3.5.22.20",
"status": "affected",
"version": "3.5.21.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS HMI (SL)",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "3.5.22.20",
"status": "affected",
"version": "3.5.21.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Runtime Toolkit",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "3.5.22.20",
"status": "affected",
"version": "3.5.21.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control for BeagleBone SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "4.21.0.0",
"status": "affected",
"version": "4.15.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control for emPC-A/iMX6 SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "4.21.0.0",
"status": "affected",
"version": "4.15.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control for IOT2000 SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "4.21.0.0",
"status": "affected",
"version": "4.15.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control for Linux ARM SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "4.21.0.0",
"status": "affected",
"version": "4.15.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control for Linux SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "4.21.0.0",
"status": "affected",
"version": "4.15.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control for PFC100 SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "4.21.0.0",
"status": "affected",
"version": "4.15.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control for PFC200 SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "4.21.0.0",
"status": "affected",
"version": "4.15.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control for PLCnext SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "4.21.0.0",
"status": "affected",
"version": "4.15.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control for Raspberry Pi SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "4.21.0.0",
"status": "affected",
"version": "4.15.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Control for WAGO Touch Panels 600 SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "4.21.0.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CODESYS Virtual Control SL",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "4.21.0.0",
"status": "affected",
"version": "4.15.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_rte_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.5.22.20",
"versionStartIncluding": "3.5.21.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_rte_for_beckhoff_cx_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.5.22.20",
"versionStartIncluding": "3.5.21.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_win_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.5.22.20",
"versionStartIncluding": "3.5.21.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_hmi_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.5.22.20",
"versionStartIncluding": "3.5.21.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_runtime_toolkit:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.5.22.20",
"versionStartIncluding": "3.5.21.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_for_beaglebone_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.21.0.0",
"versionStartIncluding": "4.15.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_for_empc_a_imx6_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.21.0.0",
"versionStartIncluding": "4.15.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_for_iot2000_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.21.0.0",
"versionStartIncluding": "4.15.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_for_linux_arm_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.21.0.0",
"versionStartIncluding": "4.15.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_for_linux_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.21.0.0",
"versionStartIncluding": "4.15.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_for_pfc100_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.21.0.0",
"versionStartIncluding": "4.15.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_for_pfc200_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.21.0.0",
"versionStartIncluding": "4.15.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_for_plcnext_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.21.0.0",
"versionStartIncluding": "4.15.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.21.0.0",
"versionStartIncluding": "4.15.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.21.0.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:codesys_virtual_control_sl:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.21.0.0",
"versionStartIncluding": "4.15.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device."
}
],
"value": "The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T06:49:54.813Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-057/"
}
],
"source": {
"advisory": "VDE-2026-057",
"defect": [
"CERT@VDE#642073"
],
"discovery": "UNKNOWN"
},
"title": "Out-of-bounds Write in CODESYS Control",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-8047",
"datePublished": "2026-05-26T06:49:54.813Z",
"dateReserved": "2026-05-06T17:12:05.142Z",
"dateUpdated": "2026-05-26T10:48:24.087Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-8047",
"date": "2026-07-23",
"epss": "0.00445",
"percentile": "0.36324"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-8047\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2026-05-26T08:16:22.447\",\"lastModified\":\"2026-07-23T11:10:00.120\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device.\"},{\"lang\":\"es\",\"value\":\"Los productos afectados realizan una comprobaci\u00f3n de longitud incorrecta al analizar las solicitudes HTTP entrantes, lo que resulta en una escritura fuera de l\u00edmites de tama\u00f1o limitado. Un atacante remoto no autenticado puede explotar esta vulnerabilidad para causar una denegaci\u00f3n de servicio mediante un bloqueo del sistema en el dispositivo afectado.\"}],\"affected\":[{\"source\":\"info@cert.vde.com\",\"affectedData\":[{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control RTE (SL)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.5.21.0\",\"lessThan\":\"3.5.22.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control RTE (for Beckhoff CX) SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.5.21.0\",\"lessThan\":\"3.5.22.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control Win (SL)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.5.21.0\",\"lessThan\":\"3.5.22.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS HMI (SL)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.5.21.0\",\"lessThan\":\"3.5.22.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Runtime Toolkit\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.5.21.0\",\"lessThan\":\"3.5.22.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for BeagleBone SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.15.0.0\",\"lessThan\":\"4.21.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for emPC-A/iMX6 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.15.0.0\",\"lessThan\":\"4.21.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for IOT2000 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.15.0.0\",\"lessThan\":\"4.21.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for Linux ARM SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.15.0.0\",\"lessThan\":\"4.21.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for Linux SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.15.0.0\",\"lessThan\":\"4.21.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for PFC100 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.15.0.0\",\"lessThan\":\"4.21.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for PFC200 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.15.0.0\",\"lessThan\":\"4.21.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for PLCnext SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.15.0.0\",\"lessThan\":\"4.21.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for Raspberry Pi SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.15.0.0\",\"lessThan\":\"4.21.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Control for WAGO Touch Panels 600 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0\",\"lessThan\":\"4.21.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Virtual Control SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.15.0.0\",\"lessThan\":\"4.21.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-26T10:45:06.909963Z\",\"id\":\"CVE-2026-8047\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1284\"}]}],\"references\":[{\"url\":\"https://www.certvde.com/en/advisories/VDE-2026-057/\",\"source\":\"info@cert.vde.com\"}]}}",
"redhat_vex": {
"current_release_date": "2026-06-05T19:10:59+00:00",
"cve": "CVE-2026-8047",
"id": "CVE-2026-8047",
"initial_release_date": "2026-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Out-of-bounds Write in CODESYS Control",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8047.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-8047\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-26T10:45:06.909963Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-26T10:48:19.543Z\"}}], \"cna\": {\"title\": \"Out-of-bounds Write in CODESYS Control\", \"source\": {\"defect\": [\"CERT@VDE#642073\"], \"advisory\": \"VDE-2026-057\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control RTE (SL)\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.5.21.0\", \"lessThan\": \"3.5.22.20\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control RTE (for Beckhoff CX) SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.5.21.0\", \"lessThan\": \"3.5.22.20\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control Win (SL)\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.5.21.0\", \"lessThan\": \"3.5.22.20\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS HMI (SL)\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.5.21.0\", \"lessThan\": \"3.5.22.20\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Runtime Toolkit\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.5.21.0\", \"lessThan\": \"3.5.22.20\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for BeagleBone SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15.0.0\", \"lessThan\": \"4.21.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for emPC-A/iMX6 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15.0.0\", \"lessThan\": \"4.21.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for IOT2000 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15.0.0\", \"lessThan\": \"4.21.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for Linux ARM SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15.0.0\", \"lessThan\": \"4.21.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for Linux SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15.0.0\", \"lessThan\": \"4.21.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for PFC100 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15.0.0\", \"lessThan\": \"4.21.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for PFC200 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15.0.0\", \"lessThan\": \"4.21.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for PLCnext SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15.0.0\", \"lessThan\": \"4.21.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for Raspberry Pi SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15.0.0\", \"lessThan\": \"4.21.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Control for WAGO Touch Panels 600 SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0\", \"lessThan\": \"4.21.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"CODESYS\", \"product\": \"CODESYS Virtual Control SL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15.0.0\", \"lessThan\": \"4.21.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.certvde.com/en/advisories/VDE-2026-057/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.4.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1284\", \"description\": \"CWE-1284 Improper Validation of Specified Quantity in Input\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_rte_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.5.22.20\", \"versionStartIncluding\": \"3.5.21.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_rte_for_beckhoff_cx_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.5.22.20\", \"versionStartIncluding\": \"3.5.21.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_win_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.5.22.20\", \"versionStartIncluding\": \"3.5.21.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_hmi_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.5.22.20\", \"versionStartIncluding\": \"3.5.21.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_runtime_toolkit:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.5.22.20\", \"versionStartIncluding\": \"3.5.21.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_for_beaglebone_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.21.0.0\", \"versionStartIncluding\": \"4.15.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_for_empc_a_imx6_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.21.0.0\", \"versionStartIncluding\": \"4.15.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_for_iot2000_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.21.0.0\", \"versionStartIncluding\": \"4.15.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_for_linux_arm_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.21.0.0\", \"versionStartIncluding\": \"4.15.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_for_linux_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.21.0.0\", \"versionStartIncluding\": \"4.15.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_for_pfc100_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.21.0.0\", \"versionStartIncluding\": \"4.15.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_for_pfc200_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.21.0.0\", \"versionStartIncluding\": \"4.15.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_for_plcnext_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.21.0.0\", \"versionStartIncluding\": \"4.15.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.21.0.0\", \"versionStartIncluding\": \"4.15.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.21.0.0\", \"versionStartIncluding\": \"0.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}, {\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:codesys:codesys_virtual_control_sl:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.21.0.0\", \"versionStartIncluding\": \"4.15.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"shortName\": \"CERTVDE\", \"dateUpdated\": \"2026-05-26T06:49:54.813Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-8047\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-26T10:48:24.087Z\", \"dateReserved\": \"2026-05-06T17:12:05.142Z\", \"assignerOrgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"datePublished\": \"2026-05-26T06:49:54.813Z\", \"assignerShortName\": \"CERTVDE\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…