A critical deserialization flaw in the CODESYS Development System could allow an unauthenticated attacker to execute arbitrary code on a victim's machine via a manipulated project file.

This vulnerability is caused by insecure deserialization of untrusted data (CWE-502). An unauthenticated attacker can exploit this by enticing a local user to open a specially crafted project file, leading to arbitrary code execution within the context of the user.

The potential for arbitrary code execution poses a severe risk to organizational security, as it could lead to full system compromise, data theft, or the installation of persistent malware. Given the CVSS score of 7.8, this vulnerability is classified as High severity. Successful exploitation could result in significant operational disruption and the loss of intellectual property if the development system is used to manage sensitive industrial control logic.

Immediate Action: Users should update their CODESYS Development System installation to version 3.5.21.40 or later immediately.

Proactive Monitoring: Security teams should monitor endpoint activity for unexpected child processes spawned by the CODESYS application and review file access logs for interactions with suspicious or untrusted project files.

Compensating Controls: Organizations should enforce strict policies regarding the opening of unsolicited or untrusted project files and utilize endpoint detection and response tools to identify and block malicious code execution attempts.

Public Exploit Available: No — exploit_available (false).

Given the potential for arbitrary code execution, this vulnerability represents a significant security risk to development environments. IT administrators must prioritize updating the CODESYS Development System to the patched version as soon as it becomes available. In the interim, personnel should exercise extreme caution when handling project files from external or unverified sources to prevent unauthorized code execution.