{"id":12415,"date":"2026-04-27T10:03:40","date_gmt":"2026-04-27T10:03:40","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/04\/27\/attackers-can-backdoor-codesys-applications-by-chaining-vulnerabilities\/"},"modified":"2026-04-27T10:03:40","modified_gmt":"2026-04-27T10:03:40","slug":"attackers-can-backdoor-codesys-applications-by-chaining-vulnerabilities","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/04\/27\/attackers-can-backdoor-codesys-applications-by-chaining-vulnerabilities\/","title":{"rendered":"Attackers Can Backdoor CODESYS Applications by Chaining Vulnerabilities"},"content":{"rendered":"

Attackers Can Backdoor CODESYS Applications by Chaining Vulnerabilities
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Multiple vulnerabilities in the CODESYS Control runtime, one of the world\u2019s most widely adopted software-based programmable logic controller (Soft PLC)<\/a> platforms.<\/p>\n

According to Nozomi Networks Labs researchers, by chaining these security flaws, an authenticated attacker can replace a legitimate industrial control application with a backdoored version, thereby escalating their privileges to full administrative control of the targeted device.<\/p>\n

CODESYS is utilized across diverse industrial sectors, from water treatment facilities and energy grids to automated manufacturing lines.<\/p>\n

Because these PLCs directly govern physical processes, an exploited vulnerability can result in halted production, equipment damage, or hazardous operating conditions.<\/p>\n

The CODESYS Control runtime manages real-time input\/output processing and network communications for automated systems.<\/p>\n

\"CODESYS
CODESYS Control for Raspberry Pi\u00a0(Source: nozominetworks)<\/em><\/figcaption><\/figure>\n

The newly discovered vulnerabilities impact how the runtime handles file permissions and backup restorations.<\/p>\n

CVE-2025-41658 (5.5, Medium):<\/strong> Incorrect default permissions allow local users to read CODESYS password hashes.<\/p>\n

CVE-2025-41659 (8.3, High):<\/strong> Improper permissions allow low-privilege users to access sensitive cryptographic data.<\/p>\n

CVE-2025-41660 (8.8, High):<\/strong> Flawed resource transfer allows restoration of a tampered boot application.<\/a><\/p>\n

The Attack Chain Workflow<\/strong><\/h2>\n
\"CODESYS
CODESYS Attack Scenario (Source: nozominetworks)<\/em><\/figcaption><\/figure>\n

To execute this attack, a threat actor first needs valid Service-level credentials.<\/p>\n

Standard security controls usually prevent this, but attackers can steal credentials via default passwords, a compromised engineering workstation, or by exploiting CVE-2025-41658 to extract hashes.<\/p>\n

Once authenticated, the attack unfolds in several stages:<\/p>\n