Vulnerability Spotlight: Unsafe deserialization vulnerabilities in CODESYS Development System
Summary: Cisco Talos discovered multiple unsafe deserialization vulnerabilities in the CODESYS Development System, the IEC 61131-3 programming tool for industrial control and automation technology, that could let an attacker execute arbitrary code on the victim machine. The issues span a variety of the software's functions and affect versions 3.5.16 and 3.5.17, which Talos tested and confirmed could be exploited; CODESYS Group has resolved the issues and released an update.
What's compelling: This is a programming tool for industrial control and automation systems, so code execution on an engineer's machine sits close to the equipment those systems run, and Talos has published Snort rules 57585-57604, 57619 and 57620 to detect exploitation attempts.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026