CVE-2021-21866

A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.

• CWE-502
• CWE-502

• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16805&token=ee583c498941d9fda86490bca98ff21928eec08a&download=Mitigation, Patch, Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2021-1301Not Applicable, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2021-1303Exploit, Third Party Advisory
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16805&token=ee583c498941d9fda86490bca98ff21928eec08a&download=Mitigation, Patch, Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2021-1301Not Applicable, Third Party Advisory

Published

Aug 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21860An exploitable integer truncation vulnerability exists withi…8.8
• CVE-2021-21861An exploitable integer truncation vulnerability exists withi…8.8
• CVE-2021-21862Multiple exploitable integer truncation vulnerabilities exis…8.8
• CVE-2021-21863A unsafe deserialization vulnerability exists in the Compone…7.8
• CVE-2021-21864A unsafe deserialization vulnerability exists in the Compone…7.8
• CVE-2021-21865A unsafe deserialization vulnerability exists in the Package…7.8
• CVE-2021-21867An unsafe deserialization vulnerability exists in the Object…7.8
• CVE-2021-21868An unsafe deserialization vulnerability exists in the Object…7.8
• CVE-2021-21869An unsafe deserialization vulnerability exists in the Engine…7.8
• CVE-2021-2187Vulnerability in the Oracle iStore product of Oracle E-Busin…8.2
• CVE-2021-21870A use-after-free vulnerability exists in the JavaScript engi…8.8
• CVE-2021-21871A memory corruption vulnerability exists in the DMG File For…7.8