CODESYS Visualization - Insufficiently Protected Credentials

A vulnerability exists in CODESYS Visualization versions prior to 4.10.0.0, allowing low-privileged users to remotely access credentials entered by other users during simultaneous login sessions. This issue arises from inadequate separation of authentication data, affecting only active visualization sessions.

Impact

Exploitation may enable an authenticated remote visualization user to intercept credentials typed by another user, potentially with elevated privileges.

Remediation

Users can update to CODESYS Visualization version 4.10.0.0. For projects using an affected version, the update requires recompiling the application and downloading it to the HMI or PLC. The CODESYS Development System and available add-ons can be installed via the CODESYS Installer or downloaded from the CODESYS Store. Additional update information is available on the CODESYS Update page.