Codesys Runtime Toolkit vulnerabilities

CVE-2022-32139 [MEDIUM] CWE-125 CVE-2022-32139: In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an o In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service condition. User Interaction is not required.

CVE-2022-32136 [MEDIUM] CWE-824 CVE-2022-32136: In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required.

CVE-2019-19789 [MEDIUM] CWE-476 CVE-2019-19789: 3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7. 3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference.

CVE-2021-30187 [MEDIUM] CWE-78 CVE-2021-30187: CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.

CVE-2025-41658 [MEDIUM] CWE-276 CVE-2025-41658: CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.