CODESYS Development System - Incorrect Default Permissions
[Advisory2026-09_VDE-2026-055] Two local privilege escalation vulnerabilities were identified in the CODESYS Development System. Specifically, the PackageManager and the IPM create temporary directories with insecure default permissions when executed with administrative privileges. This allows low-privileged local users to modify a temporary bootstrap file to force the deployment of arbitrary components, or to exploit a Time-of-Check to Time-of-Use (TOCTOU) race condition to replace digitally…
EPSS 0.00 CVE-2026-44468 CVE-2026-44469 CODESYS DE