{"schema":"threatline.record/2","record":{"id":"CVE-2026-79625","aliases":[],"summary":"Improper Synchronization in Monitoring in CODESYS Control Runtime","details":"Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.","categories":["Unclassified"],"product":"Control RTE (SL)","vendor":"CODESYS","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control RTE (SL)","vendor":"CODESYS","versions":[{"lessThan":"3.5.22.40","status":"affected","version":"3.0.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control RTE (for Beckhoff CX) SL","vendor":"CODESYS","versions":[{"lessThan":"3.5.22.40","status":"affected","version":"3.0.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control Win (SL)","vendor":"CODESYS","versions":[{"lessThan":"3.5.22.40","status":"affected","version":"3.0.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Runtime Toolkit","vendor":"CODESYS","versions":[{"lessThan":"3.5.22.40","status":"affected","version":"3.0.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Safety SIL2","vendor":"CODESYS","versions":[{"lessThan":"3.5.22.40","status":"affected","version":"3.0.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"HMI (SL)","vendor":"CODESYS","versions":[{"lessThan":"3.5.22.40","status":"affected","version":"3.0.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Development System 3","vendor":"CODESYS","versions":[{"lessThan":"3.5.22.40","status":"affected","version":"3.0.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control for BeagleBone SL","vendor":"CODESYS","versions":[{"lessThan":"4.23.0.0","status":"affected","version":"3.5.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control for emPC-A/iMX6 SL","vendor":"CODESYS","versions":[{"lessThan":"4.23.0.0","status":"affected","version":"3.5.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control for IOT2000 SL","vendor":"CODESYS","versions":[{"lessThan":"4.23.0.0","status":"affected","version":"3.5.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control for Linux ARM SL","vendor":"CODESYS","versions":[{"lessThan":"4.23.0.0","status":"affected","version":"3.5.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control for Linux SL","vendor":"CODESYS","versions":[{"lessThan":"4.23.0.0","status":"affected","version":"3.5.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control for PFC100 SL","vendor":"CODESYS","versions":[{"lessThan":"4.23.0.0","status":"affected","version":"3.5.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control for PFC200 SL","vendor":"CODESYS","versions":[{"lessThan":"4.23.0.0","status":"affected","version":"3.5.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control for PLCnext SL","vendor":"CODESYS","versions":[{"lessThan":"4.23.0.0","status":"affected","version":"3.5.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control for Raspberry Pi SL","vendor":"CODESYS","versions":[{"lessThan":"4.23.0.0","status":"affected","version":"3.5.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Control for WAGO Touch Panels 600 SL","vendor":"CODESYS","versions":[{"lessThan":"4.23.0.0","status":"affected","version":"3.5.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Virtual Control SL","vendor":"CODESYS","versions":[{"lessThan":"4.23.0.0","status":"affected","version":"3.5.0.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control RTE (SL)","ecosystem":null},"version":"3.5.22.40","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control RTE (for Beckhoff CX) SL","ecosystem":null},"version":"3.5.22.40","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control Win (SL)","ecosystem":null},"version":"3.5.22.40","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Runtime Toolkit","ecosystem":null},"version":"3.5.22.40","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Safety SIL2","ecosystem":null},"version":"3.5.22.40","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"HMI (SL)","ecosystem":null},"version":"3.5.22.40","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Development System 3","ecosystem":null},"version":"3.5.22.40","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control for BeagleBone SL","ecosystem":null},"version":"4.23.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control for emPC-A/iMX6 SL","ecosystem":null},"version":"4.23.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control for IOT2000 SL","ecosystem":null},"version":"4.23.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control for Linux ARM SL","ecosystem":null},"version":"4.23.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control for Linux SL","ecosystem":null},"version":"4.23.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control for PFC100 SL","ecosystem":null},"version":"4.23.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control for PFC200 SL","ecosystem":null},"version":"4.23.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control for PLCnext SL","ecosystem":null},"version":"4.23.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control for Raspberry Pi SL","ecosystem":null},"version":"4.23.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Control for WAGO Touch Panels 600 SL","ecosystem":null},"version":"4.23.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","source_modified_at":"2026-09-30T13:49:14.992Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Virtual Control SL","ecosystem":null},"version":"4.23.0.0","basis":"first unaffected version stated in the CVE record"}],"cvss":7.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00229,"percentile":0.13009,"score_date":"2026-10-23"},"published_at":"2026-09-30T09:23:16.775Z","modified_at":"2026-09-30T13:49:14.992Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-79625","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-30T13:49:14.992Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79625","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.certvde.com/en/advisories/VDE-2026-097/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-30T13:49:04.420443Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-30T13:49:14.992Z","content_hash":"bee4660593bcec3f362bb572283e936c78de43818f90738684c62e2770175e1d"}}