CVE-2026-79625
Received Received - Intake

Race Condition in Monitoring System Leads to Data Corruption

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: CERT VDE

Description
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-79625
EUVD
EUVD-2026-89729

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
codesys control_runtime to 3.5.22.40 (inc)
codesys development_system to 3.5.22.40 (inc)
codesys runtime_toolkit to 3.5.22.40 (inc)
codesys safety_sil2 to 3.5.22.40 (inc)
codesys control_rte to 3.5.22.40 (inc)
codesys win to 3.5.22.40 (inc)
codesys linux to 3.5.22.40 (inc)
codesys raspberry_pi to 3.5.22.40 (inc)
codesys plcnext to 3.5.22.40 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper synchronization in the monitoring functionality of CODESYS Control Runtime systems. When multiple clients send concurrent requests, it can lead to incorrect data reads or writes, memory corruption, unexpected behavior, malfunction, or denial-of-service conditions. An authenticated remote attacker with monitoring access can exploit this issue to disrupt operations.

Detection Guidance

To detect this vulnerability, monitor for unusual concurrent access patterns to the CmpMonitor2 component in CODESYS Control Runtime systems. Check for unexpected data corruption or denial-of-service conditions in PLCs using the CODESYS Runtime Toolkit or Safety SIL2. Review logs for multiple simultaneous client requests via the CODESYS protocol.

Impact Analysis

This vulnerability can cause incorrect data processing, memory corruption, unexpected system behavior, or denial-of-service conditions. It may disrupt operations of PLCs or other affected systems, especially if multiple clients access them simultaneously via the CODESYS protocol.

Compliance Impact

This vulnerability could lead to incorrect data processing or denial-of-service conditions, which may violate integrity and availability requirements in standards like GDPR and HIPAA. Unauthorized data corruption or processing errors could result in non-compliance with data integrity and security controls mandated by these regulations.

Mitigation Strategies

Immediately update affected CODESYS products to version 3.5.22.40 or later. For some systems, update to version 4.23.0.0 when available in Q4 2026. Disable external client access to the Simulation Runtime in the CODESYS Development System if not required. Restrict monitoring access to authenticated users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart