CVE-2025-41658

Executive Summary

CVE-2025-41658 is a local information disclosure vulnerability affecting CODESYS Runtime Toolkit-based products. The flaw stems from default file permissions that allow low-privileged operating system users to access sensitive files on the host system. With a CVSS score of 5.5 (Medium), the vulnerability requires local access but no user interaction, making it a credible threat in shared or multi-user industrial environments. No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not yet issued a patch. The EPSS score of 0.0% indicates very low exploitation activity in the wild, but the risk remains for exposed systems.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs low-level OS privileges.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Sensitive files (e.g., configuration, credentials) can be read.
• Integrity (I): None (N) – No file modification is possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is local-only and requires an existing foothold, but it can expose critical runtime data.

Deep Dive & Mechanics

CODESYS Runtime Toolkit is a software framework used to build industrial control system (ICS) runtime environments. It runs as a service on Windows and Linux platforms, managing PLC logic, communication, and configuration files.

The vulnerability lies in the default file system permissions applied during installation. CODESYS Runtime creates directories and files (e.g., C:\ProgramData\CODESYS\, /var/opt/CODESYS/) with overly permissive ACLs. Specifically, the Everyone or Users group may have read access to sensitive files such as:

• Project archives (.project, .archive)
• Device configuration files (.device)
• Communication certificates and keys
• Log files containing IP addresses or credentials

A low-privileged user on the same machine can enumerate these files and extract sensitive data. The attack does not require any special CODESYS API calls—only standard OS file operations.

Root Cause: The installer does not restrict permissions to the CODESYS service account or administrators, leaving files readable by all local users.

Vulnerable vs. Patched Code

Since no patch is available, the comparison is between default (vulnerable) and hardened (recommended) configurations.

Vulnerable (Default):

# Linux example: directory permissions
ls -la /var/opt/CODESYS/
drwxrwxrwx 2 root root 4096 ... projects
-rw-rw-rw- 1 root root 1024 ... config.xml

Patched (Hardened):

# Recommended permissions
chmod 750 /var/opt/CODESYS/
chown root:codesys /var/opt/CODESYS/
chmod 640 /var/opt/CODESYS/config.xml

On Windows, the vulnerable state would show Everyone or Users with Read access in the security properties. The hardened state would remove those groups and add only SYSTEM and the CODESYS service account.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites: Local shell access as a low-privileged user (e.g., guest or user).

Step 1: Enumerate CODESYS directories

# Linux
find /var/opt/CODESYS/ -type f 2>/dev/null
find /opt/CODESYS/ -type f 2>/dev/null

# Windows (PowerShell)
Get-ChildItem -Path "C:\ProgramData\CODESYS" -Recurse -File
Get-ChildItem -Path "C:\Program Files\CODESYS" -Recurse -File

Step 2: Extract sensitive files

# Copy configuration files
cp /var/opt/CODESYS/projects/config.xml /tmp/
cat /var/opt/CODESYS/logs/*.log | grep -i "password\|secret\|key"

Step 3: Exfiltrate data (e.g., via SCP, HTTP POST, or USB)

Blue Team (Defender)

Detection:

• Monitor for unusual file access to CODESYS directories by non-service accounts.
• Use Sysmon Event ID 11 (FileCreate) and 4663 (Attempt to access an object) on Windows.
• On Linux, audit with auditd rules for /var/opt/CODESYS/.

Hunting:

# Linux auditd rule
auditctl -w /var/opt/CODESYS/ -p r -k codesys_access

# Check logs
ausearch -k codesys_access --start today

Prevention:

• Apply the hardened permissions immediately (see Remediation).
• Restrict interactive logon to the CODESYS host.
• Use AppLocker or SELinux to limit file access.

Indicators of Compromise (IOCs)

• File Paths:

  • /var/opt/CODESYS/projects/*.xml
  • /var/opt/CODESYS/logs/*.log
  • C:\ProgramData\CODESYS\*
  • C:\Program Files\CODESYS\*

• Registry Keys (Windows):

  • HKLM\SOFTWARE\CODESYS\
  • HKCU\Software\CODESYS\

• Process Anomalies:

  • cmd.exe or powershell.exe accessing CODESYS directories from a non-service account.
  • cat, type, or copy commands targeting CODESYS files.

• Network IOCs:

  • Outbound connections from the CODESYS host to unknown IPs (if exfiltration occurs).

Detection Engineering

YARA Rule

rule CVE_2025_41658_CODESYS_FileAccess
{
    meta:
        description = "Detects access to CODESYS sensitive files by low-privileged users"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-41658"
    strings:
        $s1 = "CODESYS" nocase
        $s2 = "config.xml" nocase
        $s3 = ".project" nocase
        $s4 = ".device" nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        any of ($s*)
}

Sigma Rule

title: Suspicious File Access to CODESYS Directories
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects low-privileged user accessing CODESYS runtime files
author: Valters IT
date: 2025-04-01
logsource:
    product: windows
    service: security
    category: file_access
detection:
    selection:
        EventID: 4663
        ObjectName|contains:
            - 'C:\ProgramData\CODESYS'
            - 'C:\Program Files\CODESYS'
        SubjectUserName|endswith:
            - 'user'
            - 'guest'
    condition: selection
falsepositives:
    - Legitimate CODESYS service account
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-41658 - Potential CODESYS Data Exfiltration";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/upload"; http_uri;
    fileext:"xml";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions (No Patch Available):

1. Harden File Permissions:
   • Linux: chmod 750 /var/opt/CODESYS/ && chown root:codesys /var/opt/CODESYS/
   • Windows: Remove Everyone and Users from the security ACL of C:\ProgramData\CODESYS\ and C:\Program Files\CODESYS\. Add only SYSTEM and the CODESYS service account with Read & Execute.
2. Restrict Local Access: Limit interactive logon to the CODESYS host to authorized administrators only.
3. Monitor File Access: Deploy the YARA/Sigma rules above and enable auditing on CODESYS directories.
4. Network Segmentation: Place CODESYS hosts on isolated OT networks with strict firewall rules.

Long-Term:

• Apply vendor patches as soon as they are released.
• Use a centralized logging solution (e.g., SIEM) to correlate file access events.
• Conduct regular permission audits on all OT assets.

Valters IT