CVE-2025-41659

A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.

• CWE-732

• https://certvde.com/de/advisories/VDE-2025-051

Published

Aug 4, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-41653An unauthenticated remote attacker can exploit a denial-of-s…7.5
• CVE-2025-41654An unauthenticated remote attacker can access information ab…8.2
• CVE-2025-41655An unauthenticated remote attacker can access a URL which ca…7.5
• CVE-2025-41656An unauthenticated remote attacker can run arbitrary command…10
• CVE-2025-41657Due to an undocumented active bluetooth stack on products de…4.3
• CVE-2025-41658CODESYS Runtime Toolkit-based products may expose sensitive …5.5
• CVE-2025-4166Vault Community and Vault Enterprise Key/Value (kv) Version …6.5
• CVE-2025-41660A low-privileged remote attacker may be able to replace the …8.8
• CVE-2025-41661An unauthenticated remote attacker can execute arbitrary com…8.8
• CVE-2025-41662Rejected reason: CVE-2025-41662 is considered redundant or u…
• CVE-2025-41663For u-link Management API an unauthenticated remote attacker…9.8
• CVE-2025-41664A low-privileged remote attacker could gain unauthorized acc…7.5