CVE-2026-79625

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.certvde.com/en/advisories/VDE-2026-097/

Configurations

No configuration.

History

30 Sep 2026, 10:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 10:17

Updated : 2026-09-30 19:57

NVD link : CVE-2026-79625

Mitre link : CVE-2026-79625

CVE.ORG link : CVE-2026-79625

JSON object : View

Products Affected

No product.

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2026-79625", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-79625", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T13:49:04.420443Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "info@cert.vde.com", "affectedData": [{"vendor": "CODESYS", "product": "Control RTE (SL)", "versions": [{"status": "affected", "version": "3.0.0.0", "lessThan": "3.5.22.40", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control RTE (for Beckhoff CX) SL", "versions": [{"status": "affected", "version": "3.0.0.0", "lessThan": "3.5.22.40", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control Win (SL)", "versions": [{"status": "affected", "version": "3.0.0.0", "lessThan": "3.5.22.40", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Runtime Toolkit", "versions": [{"status": "affected", "version": "3.0.0.0", "lessThan": "3.5.22.40", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Safety SIL2", "versions": [{"status": "affected", "version": "3.0.0.0", "lessThan": "3.5.22.40", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "HMI (SL)", "versions": [{"status": "affected", "version": "3.0.0.0", "lessThan": "3.5.22.40", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Development System 3", "versions": [{"status": "affected", "version": "3.0.0.0", "lessThan": "3.5.22.40", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for BeagleBone SL", "versions": [{"status": "affected", "version": "3.5.0.0", "lessThan": "4.23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for emPC-A/iMX6 SL", "versions": [{"status": "affected", "version": "3.5.0.0", "lessThan": "4.23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for IOT2000 SL", "versions": [{"status": "affected", "version": "3.5.0.0", "lessThan": "4.23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for Linux ARM SL", "versions": [{"status": "affected", "version": "3.5.0.0", "lessThan": "4.23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for Linux SL", "versions": [{"status": "affected", "version": "3.5.0.0", "lessThan": "4.23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for PFC100 SL", "versions": [{"status": "affected", "version": "3.5.0.0", "lessThan": "4.23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for PFC200 SL", "versions": [{"status": "affected", "version": "3.5.0.0", "lessThan": "4.23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for PLCnext SL", "versions": [{"status": "affected", "version": "3.5.0.0", "lessThan": "4.23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for Raspberry Pi SL", "versions": [{"status": "affected", "version": "3.5.0.0", "lessThan": "4.23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Control for WAGO Touch Panels 600 SL", "versions": [{"status": "affected", "version": "3.5.0.0", "lessThan": "4.23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "Virtual Control SL", "versions": [{"status": "affected", "version": "3.5.0.0", "lessThan": "4.23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-30T10:17:17.273", "references": [{"url": "https://www.certvde.com/en/advisories/VDE-2026-097/", "source": "info@cert.vde.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition."}], "lastModified": "2026-09-30T19:57:08.043", "sourceIdentifier": "info@cert.vde.com"}