Vulnerability · Published Aug 4, 2025 · Assigned by CERTVDE
CVE-2025-41658CODESYS Toolkit Exposes Sensitive Files via Default Permissions
Medium 5.5
In plain English
A medium-severity incorrect default permissions in Control for BeagleBone SL from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.1%top 96.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CODESYS | Runtime Toolkit | 0.0.0.0 – before 3.5.21.20 |
| CODESYS | Control for BeagleBone SL | 0.0.0.0 – before 4.16.0.0 |
| CODESYS | Control for emPC-A/iMX6 SL | 0.0.0.0 – before 4.16.0.0 |
| CODESYS | Control for IOT2000 SL | 0.0.0.0 – before 4.16.0.0 |
| CODESYS | Control for Linux ARM SL | 0.0.0.0 – before 4.16.0.0 |
| CODESYS | Control for Linux SL | 0.0.0.0 – before 4.16.0.0 |
| CODESYS | Control for PFC100 SL | 0.0.0.0 – before 4.16.0.0 |
| CODESYS | Control for PFC200 SL | 0.0.0.0 – before 4.16.0.0 |
| CODESYS | Control for PLCnext SL | 0.0.0.0 – before 4.16.0.0 |
| CODESYS | Control for Raspberry Pi SL | 0.0.0.0 – before 4.16.0.0 |
| CODESYS | Control for WAGO Touch Panels 600 SL | 0.0.0.0 – before 4.16.0.0 |
| CODESYS | Virtual Control SL | 0.0.0.0 – before 4.16.0.0 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N