CVE-2026-3509

An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://certvde.com/de/advisories/VDE-2026-018

Configurations

No configuration.

History

17 Jun 2026, 10:43

Type	Values Removed	Values Added
Summary		(es) Un atacante remoto no autenticado podría controlar la cadena de formato de los mensajes procesados por el Registro de Auditoría del sistema de tiempo de ejecución CODESYS Control, resultando potencialmente en una condición de denegación de servicio (DoS).

24 Mar 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-24 08:16

Updated : 2026-06-17 10:43

NVD link : CVE-2026-3509

Mitre link : CVE-2026-3509

CVE.ORG link : CVE-2026-3509

JSON object : View

Products Affected

No product.

CWE

CWE-134

Use of Externally-Controlled Format String

{"id": "CVE-2026-3509", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3509", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T12:35:33.893071Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "info@cert.vde.com", "affectedData": [{"vendor": "CODESYS", "product": "CODESYS Control RTE (SL)", "versions": [{"status": "affected", "version": "3.5.17.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control RTE (for Beckhoff CX) SL", "versions": [{"status": "affected", "version": "3.5.17.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control Win (SL)", "versions": [{"status": "affected", "version": "3.5.17.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Runtime Toolkit", "versions": [{"status": "affected", "version": "3.5.17.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for BeagleBone SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for emPC-A/iMX6 SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for IOT2000 SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for Linux ARM SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for Linux SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for PFC100 SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for PFC200 SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for PLCnext SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for Raspberry Pi SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for WAGO Touch Panels 600 SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Virtual Control SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-24T08:16:01.657", "references": [{"url": "https://certvde.com/de/advisories/VDE-2026-018", "source": "info@cert.vde.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial\u2011of\u2011service (DoS) condition."}, {"lang": "es", "value": "Un atacante remoto no autenticado podr\u00eda controlar la cadena de formato de los mensajes procesados por el Registro de Auditor\u00eda del sistema de tiempo de ejecuci\u00f3n CODESYS Control, resultando potencialmente en una condici\u00f3n de denegaci\u00f3n de servicio (DoS)."}], "lastModified": "2026-06-17T10:43:41.653", "sourceIdentifier": "info@cert.vde.com"}