CODESYS Development System Deserialization Vulnerability Leading to Arbitrary Code Execution

A deserialization vulnerability has been identified in the CODESYS Development System, specifically in versions prior to 3.5.21.40. This vulnerability allows an unauthenticated attacker to execute arbitrary code by tricking a local user into opening a manipulated CODESYS project file. The code execution occurs in the context of the user who opened the file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the user context, potentially compromising system integrity, confidentiality, and availability.

Remediation

Users can update to CODESYS Development System version 3.5.21.40 or later. The CODESYS Development System is available for download via the CODESYS Installer, the CODESYS Store, or the CODESYS Update area.