CODESYS Control Runtime - Improper Synchronization in Monitoring

Plan PatchCVSS 8.1VDE-2026-097Sep 30, 2026

CODESYSPhoenix ContactWAGOBeckhoffManufacturing

Attack path

Attack VectorNetwork

Auth RequiredLow

ComplexityLow

User InteractionNone needed

Summary

CODESYS Control runtime systems contain an improper synchronization vulnerability in the CmpMonitor2 component that processes concurrent read and write requests to PLC application data. When multiple clients (such as HMIs or the CODESYS Development System with external access enabled) send simultaneous monitoring requests, race conditions cause incorrect data to be read from or written to PLC memory. This affects CODESYS Control RTE, Control Win, Runtime Toolkit, Safety SIL2, HMI, Development System 3, and numerous embedded platform variants (Beckhoff CX, WAGO PFC, Raspberry Pi, BeagleBone, Linux ARM, and others). The vulnerability requires valid monitoring credentials and network access to the CODESYS protocol port.

What this means

What could happen

An authenticated attacker with network access could send concurrent monitoring requests to corrupt data being read from or written to the PLC, potentially causing incorrect process values, failed safety interlocks, or unexpected device behavior in manufacturing systems.

Who's at risk

Manufacturing facilities using CODESYS-based PLCs and controllers from Beckhoff (CX series), WAGO (PFC series, touch panels), Phoenix Contact, and any system running CODESYS Control runtime, Development System 3, or Safety SIL2. Particularly affects facilities with multiple concurrent clients (HMIs, engineering workstations, development systems) accessing the same PLC for monitoring or process control.

How it could be exploited

An attacker with valid monitoring credentials connects to the PLC via CODESYS protocol and sends overlapping read/write requests targeting PLC application data. Due to improper synchronization in the CmpMonitor2 component, these concurrent requests cause race conditions, resulting in stale or corrupted data being returned or persisted to the PLC memory.

Prerequisites

Network access to CODESYS protocol port (typically TCP 11740)
Valid monitoring credentials for the affected PLC
Ability to send concurrent requests (either from external client such as HMI or CODESYS Development System with external access explicitly enabled)
Target running vulnerable CODESYS runtime version

remotely exploitablerequires authentication (monitoring credentials)affects safety-certified systems (Safety SIL2)low complexity attack (concurrent requests)affects multiple major industrial control platform vendorsdata corruption impact on process variables

Exploitability

Unlikely to be exploited — EPSS score 0.2%

Affected products (18)

18 with fix

ProductAffected VersionsFix Status

Control RTE (SL) 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40

Control RTE (for Beckhoff CX) SL 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40

Control Win (SL) 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40

Runtime Toolkit 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40

Safety SIL2 3.0.0.0<3.5.22.40≥ 3.0.0.0, < 3.5.22.403.5.22.40

Remediation & Mitigation

0/9

Do now

0/1

HARDENINGRestrict network access to CODESYS protocol ports to authorized engineering and HMI systems only

Schedule — requires maintenance window

0/8

Patching may require device reboot — plan for process interruption

Control RTE (for Beckhoff CX) SL 3.0.0.0<3.5.22.40

HOTFIXUpdate CODESYS Control RTE (for Beckhoff CX) SL to version 3.5.22.40 or later

All products

HOTFIXUpdate CODESYS Control RTE (SL) to version 3.5.22.40 or later

HOTFIXUpdate CODESYS Control Win (SL) to version 3.5.22.40 or later

HOTFIXUpdate CODESYS Runtime Toolkit to version 3.5.22.40 or later

HOTFIXUpdate CODESYS Safety SIL2 to version 3.5.22.40 or later

HOTFIXUpdate CODESYS HMI (SL) to version 3.5.22.40 or later

HOTFIXUpdate CODESYS Development System 3 to version 3.5.22.40 or later

HOTFIXUpdate all CODESYS Control variants for Linux/ARM/embedded platforms (BeagleBone, emPC-A/iMX6, IOT2000, Raspberry Pi, PLCnext, etc.) to version 4.23.0.0 or later

CVEs (1)

CVE-2026-79625

View full CERT@VDE advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/34617ec3-047e-4042-972f-c7f849950c5c

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.