{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3509", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2026-03-04T09:24:19.745Z", "datePublished": "2026-03-24T07:42:33.820Z", "dateUpdated": "2026-03-26T12:35:48.666Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CODESYS Control RTE (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "3.5.17.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control RTE (for Beckhoff CX) SL", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "3.5.17.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control Win (SL)", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "3.5.17.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Runtime Toolkit", "vendor": "CODESYS", "versions": [{"lessThan": "3.5.22.0", "status": "affected", "version": "3.5.17.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for BeagleBone SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "4.1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for emPC-A/iMX6 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "4.1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for IOT2000 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "4.1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for Linux ARM SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "4.1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for Linux SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "4.1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for PFC100 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "4.1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for PFC200 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "4.1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for PLCnext SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "4.1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for Raspberry Pi SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "4.1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Control for WAGO Touch Panels 600 SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "4.1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CODESYS Virtual Control SL", "vendor": "CODESYS", "versions": [{"lessThan": "4.21.0.0", "status": "affected", "version": "4.1.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial\u2011of\u2011service (DoS) condition.<br>"}], "value": "An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial\u2011of\u2011service (DoS) condition."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-134", "description": "CWE-134 Use of Externally-Controlled Format String", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2026-03-24T07:42:33.820Z"}, "references": [{"url": "https://certvde.com/de/advisories/VDE-2026-018"}], "source": {"advisory": "VDE-2026-018", "defect": ["CERT@VDE#641968"], "discovery": "UNKNOWN"}, "title": "CODESYS Control Audit Log Format String DoS", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T12:35:33.893071Z", "id": "CVE-2026-3509", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T12:35:48.666Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3509", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T12:35:33.893071Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T12:35:44.638Z"}}], "cna": {"title": "CODESYS Control Audit Log Format String DoS", "source": {"defect": ["CERT@VDE#641968"], "advisory": "VDE-2026-018", "discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CODESYS", "product": "CODESYS Control RTE (SL)", "versions": [{"status": "affected", "version": "3.5.17.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control RTE (for Beckhoff CX) SL", "versions": [{"status": "affected", "version": "3.5.17.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control Win (SL)", "versions": [{"status": "affected", "version": "3.5.17.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Runtime Toolkit", "versions": [{"status": "affected", "version": "3.5.17.0", "lessThan": "3.5.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for BeagleBone SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for emPC-A/iMX6 SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for IOT2000 SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for Linux ARM SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for Linux SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for PFC100 SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for PFC200 SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for PLCnext SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for Raspberry Pi SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Control for WAGO Touch Panels 600 SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "CODESYS", "product": "CODESYS Virtual Control SL", "versions": [{"status": "affected", "version": "4.1.0.0", "lessThan": "4.21.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://certvde.com/de/advisories/VDE-2026-018"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial\u2011of\u2011service (DoS) condition.", "supportingMedia": [{"type": "text/html", "value": "An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial\u2011of\u2011service (DoS) condition.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-134", "description": "CWE-134 Use of Externally-Controlled Format String"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2026-03-24T07:42:33.820Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3509", "state": "PUBLISHED", "dateUpdated": "2026-03-26T12:35:48.666Z", "dateReserved": "2026-03-04T09:24:19.745Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2026-03-24T07:42:33.820Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial\u2011of\u2011service (DoS) condition."}], "id": "CVE-2026-3509", "lastModified": "2026-03-24T15:53:48.067", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "info@cert.vde.com", "type": "Primary"}]}, "published": "2026-03-24T08:16:01.657", "references": [{"source": "info@cert.vde.com", "url": "https://certvde.com/de/advisories/VDE-2026-018"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}], "source": "info@cert.vde.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for BeagleBone SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_beaglebone_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for emPC-A/iMX6 SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_empc-a/imx6_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for IOT2000 SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_iot2000_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for Linux ARM SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_linux_arm_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for Linux SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_linux_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for PFC100 SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_pfc100_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for PFC200 SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_pfc200_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for PLCnext SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_plcnext_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for Raspberry Pi SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_raspberry_pi_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "CODESYS Control for WAGO Touch Panels 600 SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_for_wago_touch_panels_600_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.5.17.0,3.5.22.0)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "CODESYS Control RTE (SL)", "source": "cna", "vendor": "CODESYS"}, "product": "control_rte_(sl)", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.5.17.0,3.5.22.0)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "CODESYS Control RTE (for Beckhoff CX) SL", "source": "cna", "vendor": "CODESYS"}, "product": "control_rte_\\(for_beckhoff_cx\\)_sl", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.5.17.0,3.5.22.0)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "CODESYS Control Win (SL)", "source": "cna", "vendor": "CODESYS"}, "product": "control_win_(sl)", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.5.17.0,3.5.22.0)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "CODESYS Runtime Toolkit", "source": "cna", "vendor": "CODESYS"}, "product": "runtime_toolkit", "vendor": "codesys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0.0,4.21.0.0)"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "CODESYS Virtual Control SL", "source": "cna", "vendor": "CODESYS"}, "product": "virtual_control_sl", "vendor": "codesys"}], "analysis": {"en": {"generated_at": "2026-03-24T09:20:57.644026+00:00", "value": {"mitigation_remediation": ["Check for and apply any available CODESYS Control runtime updates that address the audit log format string vulnerability.", "If no patch is available, consider disabling or restricting audit logging to reduce exposure to this denial\u2011of-service surface.", "Monitor the system for abnormal log activity and address any denial\u2011of\u2011service symptoms promptly."], "summary": {"action": "Patch", "impact": "Denial\u2011of\u2011service"}, "threat_synthesis": {"affected_systems": "The affected software is the CODESYS Control runtime platform, including CODESYS Control RTE (SL), CODESYS Control RTE (for Beckhoff CX) SL, CODESYS Control Win (SL), CODESYS Control for BeagleBone SL, CODESYS Control for IOT2000 SL, CODESYS Control for Linux ARM SL, CODESYS Control for Linux SL, CODESYS Control for PFC100 SL, CODESYS Control for PFC200 SL, CODESYS Control for PLCnext SL, CODESYS Control for Raspberry Pi SL, CODESYS Control for WAGO Touch Panels 600 SL, CODESYS Control for emPC\u2011A/iMX6 SL, CODESYS Runtime Toolkit, and CODESYS Virtual Control SL. No specific version information was supplied, so all releases of these products are potentially impacted.", "description_and_impact": "The vulnerability allows an attacker to inject arbitrary format specifiers into audit log messages processed by the CODESYS Control runtime system. By sending a carefully crafted log entry, an unauthenticated remote user can cause the audit logger to crash or consume excessive resources, resulting in a denial\u2011of\u2011service condition. This is a classic format string weakness, identified as CWE-134.", "risk_and_exploitability": "The CVSS score of 7.5 indicates moderate\u2011to\u2011high severity. Although the EPSS score is not available, the lack of inclusion in the CISA KEV catalog suggests no known active exploitation, but the remote nature of the attack and the ease of triggering a crash mean that the risk remains significant. An attacker can exploit this vulnerability from any networked device that can reach the audit logger interface, without requiring authentication or privileges."}}}}, "created": "2026-03-25T11:48:52.648939+00:00", "updated": "2026-03-25T20:39:47.860574+00:00", "vendors": ["codesys", "codesys$PRODUCT$control_for_beaglebone_sl", "codesys$PRODUCT$control_for_empc-a/imx6_sl", "codesys$PRODUCT$control_for_iot2000_sl", "codesys$PRODUCT$control_for_linux_arm_sl", "codesys$PRODUCT$control_for_linux_sl", "codesys$PRODUCT$control_for_pfc100_sl", "codesys$PRODUCT$control_for_pfc200_sl", "codesys$PRODUCT$control_for_plcnext_sl", "codesys$PRODUCT$control_for_raspberry_pi_sl", "codesys$PRODUCT$control_for_wago_touch_panels_600_sl", "codesys$PRODUCT$control_rte_(sl)", "codesys$PRODUCT$control_rte_\\(for_beckhoff_cx\\)_sl", "codesys$PRODUCT$control_win_(sl)", "codesys$PRODUCT$runtime_toolkit", "codesys$PRODUCT$virtual_control_sl"]}