CVE-2025-41700: 
CODESYS Development System vulnerability analysis and mitigation

CVE-2025-41700 is a deserialization of untrusted data vulnerability in the CODESYS Development System that allows an unauthenticated attacker to trick a local user into executing arbitrary code by opening a manipulated CODESYS project file. The vulnerability affects all CODESYS Development System versions prior to 3.5.21.40. It was published on December 1, 2025, and assigned by CERT VDE. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, ENISA EUVD).

The root cause is improper deserialization of untrusted data (CWE-502), mapped to CAPEC-586 (Object Injection). An attacker crafts a malicious CODESYS project file that, when opened by a victim using the CODESYS Development System, triggers unsafe deserialization and executes arbitrary code in the context of the local user. The attack vector is local, requires no privileges, but does require user interaction (the victim must open the malicious file). No public proof-of-concept code has been identified at this time (CERT VDE Advisory, ENISA EUVD).

Successful exploitation results in full compromise of confidentiality, integrity, and availability on the affected workstation, as arbitrary code executes with the privileges of the local user who opened the malicious file. An attacker could exfiltrate sensitive engineering project data, modify PLC programs or configurations, or use the compromised development workstation as a pivot point for further attacks against industrial control system (ICS) environments. The scope is limited to the affected user session, but in OT/ICS contexts, this can have significant downstream consequences for operational technology (Red Hat Advisory, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-41700 as of the available data. The EPSS score is approximately 0.021% (0.000210), indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA referenced it in a weekly vulnerability bulletin for the week of December 1, 2025. Exploitation requires social engineering to convince a target to open a crafted project file, which limits opportunistic exploitation but remains a realistic threat in targeted ICS/OT campaigns (CISA Bulletin, ENISA EUVD).

1. Craft malicious project file: The attacker creates a specially crafted CODESYS project file (.project or similar) that embeds a malicious serialized object payload designed to trigger arbitrary code execution upon deserialization by the CODESYS Development System.
2. Deliver the file to the target: The attacker distributes the malicious file via phishing email, a compromised file share, a supply chain vector, or social engineering — convincing an engineer or developer to open the file.
3. Victim opens the file: The local user opens the manipulated project file using a vulnerable version of the CODESYS Development System (prior to 3.5.21.40).
4. Deserialization triggers code execution: The CODESYS application deserializes the untrusted data in the project file without adequate validation, causing the embedded payload to execute arbitrary code in the context of the local user.
5. Post-exploitation: The attacker's code runs with the victim's privileges, enabling actions such as deploying malware, exfiltrating engineering data, modifying PLC project files, or establishing persistence on the engineering workstation (CERT VDE Advisory, ENISA EUVD).

• File System: Unexpected or newly created executable files, scripts, or DLLs in the CODESYS installation directory or user temp folders following the opening of a project file; modified CODESYS project files with anomalous binary content or unexpected embedded objects.
• Process: Unusual child processes spawned by the CODESYS Development System process (e.g., cmd.exe, powershell.exe, wscript.exe, or network utilities like curl, wget) shortly after a project file is opened.
• Network: Unexpected outbound network connections from the CODESYS Development System process to external or unknown IP addresses, particularly following project file open events.
• Logs: Windows Event Logs showing process creation events (Event ID 4688) with CODESYS as the parent process and unexpected child processes; application crash logs or error events in the CODESYS log directory around the time of file opening.

CODESYS has released version 3.5.21.40 of the CODESYS Development System, which addresses this vulnerability. Users should upgrade to version 3.5.21.40 or later as the primary remediation. As a workaround, engineers should avoid opening CODESYS project files received from untrusted or unverified sources, and organizations should implement file integrity controls and restrict project file sharing to trusted channels. Network segmentation of engineering workstations from broader IT and OT networks can limit the impact of a successful compromise (CERT VDE Advisory, ENISA EUVD).

The vulnerability was assigned and disclosed by CERT VDE, the German ICS/OT-focused CERT, and was noted in CISA's weekly vulnerability bulletin for the week of December 1, 2025. RedPacketSecurity and other security aggregators shared the CVE on social media shortly after publication. No significant independent researcher commentary or detailed technical write-ups have been identified beyond standard vulnerability database entries (CISA Bulletin, CERT VDE Advisory).