OTPulse

CODESYS Gateway Client - Uncontrolled Memory Allocation

Plan PatchCVSS 7.5VDE-2026-094Sep 30, 2026
CODESYSManufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

The CODESYS Gateway Client component lacks limits on memory allocation based on a size field received in gateway responses. A malicious or compromised CODESYS Gateway server can send responses with extremely large size values, causing client applications to allocate excessive memory and crash. This results in denial of service for PLC communication and control. The vulnerability affects multiple CODESYS products that use the gateway client for PLC communication, including development systems, gateway servers, and HMI/OPC applications.

What this means
What could happen
An attacker could run a malicious CODESYS Gateway server that causes client applications to consume excessive memory, forcing them to crash and stopping communication between engineering workstations and PLCs. This would disrupt remote monitoring and control of industrial processes.
Who's at risk
Manufacturing organizations using CODESYS products for PLC programming, control, and communication. This includes anyone running CODESYS Development System, Gateway, Edge Gateway, HMI, OPC DA Server, PLCHandler, or Runtime Toolkit versions from 3.0.0.0 to 3.5.22.39 (Windows products) or 3.15.0.0 to 4.22.x.x (Linux Edge Gateway).
How it could be exploited
An attacker sets up a malicious CODESYS Gateway server and waits for an affected client application to connect to it. When the client connects, the malicious server sends a specially crafted response with an extremely large size field. The client reads this field and allocates excessive memory without validation, exhausting available RAM and causing the application to crash.
Prerequisites
  • Network access to the client application on the port used for gateway communication (typically 11740 or 11741)
  • Client application must initiate a connection to an attacker-controlled or compromised CODESYS Gateway server
remotely exploitableno authentication requiredlow complexityaffects control system availability
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Development System 3 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40
Gateway 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40
Edge Gateway for Windows 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40
HMI (SL) 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40
OPC DA Server SL 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40
PLCHandler 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40
Runtime Toolkit 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40
Edge Gateway for Linux 3.15.0.0<4.23.0.0≥ 3.15.0.0, < 4.23.0.04.23.0.0
Remediation & Mitigation
0/6
Do now
0/1
WORKAROUNDRestrict network access to CODESYS Gateway servers to authorized engineering workstations only using firewall rules
Schedule — requires maintenance window
0/5

Patching may require device reboot — plan for process interruption

HOTFIXUpdate CODESYS Development System 3 to version 3.5.22.40 or later
HOTFIXUpdate CODESYS Gateway to version 3.5.22.40 or later
HOTFIXUpdate CODESYS Edge Gateway for Windows to version 3.5.22.40 or later
HOTFIXUpdate CODESYS Edge Gateway for Linux to version 4.23.0.0 or later
HOTFIXUpdate CODESYS HMI (SL), OPC DA Server SL, PLCHandler, and Runtime Toolkit to version 3.5.22.40 or later
View full CERT@VDE advisory
API: /api/v1/advisories/32f44cf8-cf33-44c8-b94e-a3c55ac820ef

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

CODESYS Gateway Client - Uncontrolled Memory Allocation | CVSS 7.5 - OTPulse