CVE-2025-41658
published 2025-08-04CVE-2025-41658: CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codesys | control_for_beaglebone_sl | >= 0.0.0.0 < 4.16.0.0 | 4.16.0.0 |
| codesys | control_for_empc-a_imx6_sl | >= 0.0.0.0 < 4.16.0.0 | 4.16.0.0 |
| codesys | control_for_iot2000_sl | >= 0.0.0.0 < 4.16.0.0 | 4.16.0.0 |
| codesys | control_for_linux_arm_sl | >= 0.0.0.0 < 4.16.0.0 | 4.16.0.0 |
| codesys | control_for_linux_sl | >= 0.0.0.0 < 4.16.0.0 | 4.16.0.0 |
| codesys | control_for_pfc100_sl | >= 0.0.0.0 < 4.16.0.0 | 4.16.0.0 |
| codesys | control_for_pfc200_sl | >= 0.0.0.0 < 4.16.0.0 | 4.16.0.0 |
| codesys | control_for_plcnext_sl | >= 0.0.0.0 < 4.16.0.0 | 4.16.0.0 |
| codesys | control_for_raspberry_pi_sl | >= 0.0.0.0 < 4.16.0.0 | 4.16.0.0 |
| codesys | control_for_wago_touch_panels_600_sl | >= 0.0.0.0 < 4.16.0.0 | 4.16.0.0 |
| codesys | runtime_toolkit | >= 0.0.0.0 < 3.5.21.20 | 3.5.21.20 |
| codesys | virtual_control_sl | >= 0.0.0.0 < 4.16.0.0 | 4.16.0.0 |