CVE-2026-44469

The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.certvde.com/en/advisories/VDE-2026-055/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*

History

24 Jul 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) El producto afectado extrae archivos de instalación a un directorio temporal con permisos predeterminados incorrectos durante la instalación administrativa. Un atacante local con pocos privilegios puede explotar una condición de carrera TOCTOU con una ventana de tiempo práctica para reemplazar archivos verificados por maliciosos antes de la instalación, lo que resulta en una escalada de privilegios local.

28 May 2026, 20:09

Type	Values Removed	Values Added
First Time		Codesys Codesys development System
References	~~() https://www.certvde.com/en/advisories/VDE-2026-055/ -~~	() https://www.certvde.com/en/advisories/VDE-2026-055/ - Third Party Advisory
CPE		cpe:2.3:a:codesys:development_system::::::::

26 May 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-26 08:16

Updated : 2026-07-24 11:10

NVD link : CVE-2026-44469

Mitre link : CVE-2026-44469

CVE.ORG link : CVE-2026-44469

JSON object : View

Products Affected

codesys

development_system

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2026-44469", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44469", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-26T10:44:51.917941Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}], "cvssMetricV40": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "info@cert.vde.com", "affectedData": [{"vendor": "CODESYS", "product": "CODESYS Development System", "versions": [{"status": "affected", "version": "3.0.0.0", "lessThan": "3.5.22.20", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-26T08:16:22.137", "references": [{"url": "https://www.certvde.com/en/advisories/VDE-2026-055/", "tags": ["Third Party Advisory"], "source": "info@cert.vde.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation."}, {"lang": "es", "value": "El producto afectado extrae archivos de instalaci\u00f3n a un directorio temporal con permisos predeterminados incorrectos durante la instalaci\u00f3n administrativa. Un atacante local con pocos privilegios puede explotar una condici\u00f3n de carrera TOCTOU con una ventana de tiempo pr\u00e1ctica para reemplazar archivos verificados por maliciosos antes de la instalaci\u00f3n, lo que resulta en una escalada de privilegios local."}], "lastModified": "2026-07-24T11:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "118C3726-FDDF-4E93-ABF6-E15B826D4CCD", "versionEndExcluding": "3.5.22.20"}], "operator": "OR"}]}], "sourceIdentifier": "info@cert.vde.com"}