CVE-2025-41658

published 2025-08-04

CVE-2025-41658: CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.

Priority P4 25 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C H I N A N

CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
codesys	control_for_beaglebone_sl	>= 0.0.0.0 < 4.16.0.0	4.16.0.0
codesys	control_for_empc-a_imx6_sl	>= 0.0.0.0 < 4.16.0.0	4.16.0.0
codesys	control_for_iot2000_sl	>= 0.0.0.0 < 4.16.0.0	4.16.0.0
codesys	control_for_linux_arm_sl	>= 0.0.0.0 < 4.16.0.0	4.16.0.0
codesys	control_for_linux_sl	>= 0.0.0.0 < 4.16.0.0	4.16.0.0
codesys	control_for_pfc100_sl	>= 0.0.0.0 < 4.16.0.0	4.16.0.0
codesys	control_for_pfc200_sl	>= 0.0.0.0 < 4.16.0.0	4.16.0.0
codesys	control_for_plcnext_sl	>= 0.0.0.0 < 4.16.0.0	4.16.0.0
codesys	control_for_raspberry_pi_sl	>= 0.0.0.0 < 4.16.0.0	4.16.0.0
codesys	control_for_wago_touch_panels_600_sl	>= 0.0.0.0 < 4.16.0.0	4.16.0.0
codesys	runtime_toolkit	>= 0.0.0.0 < 3.5.21.20	3.5.21.20
codesys	virtual_control_sl	>= 0.0.0.0 < 4.16.0.0	4.16.0.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-276