CVE-2025-41691

Executive Summary

CVE-2025-41691 is a high-severity denial-of-service (DoS) vulnerability affecting CODESYS Control runtime systems. An unauthenticated remote attacker can trigger a NULL pointer dereference by sending specially crafted communication requests, causing the runtime to crash and resulting in a DoS condition. The vulnerability has a CVSS score of 7.5, indicating significant impact on availability. No public proof-of-concept (PoC) code, exploit, or patch is currently available. The vendor, CODESYS, has not yet released a security advisory or patch. This vulnerability is particularly concerning for industrial control systems (ICS) and operational technology (OT) environments where availability is critical.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects CODESYS Control runtime systems, which are proprietary industrial control software.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: High – Unauthenticated remote exploitation can cause a denial of service, impacting critical industrial processes.

Deep Dive & Mechanics

The vulnerability resides in the communication handling logic of CODESYS Control runtime systems. When the runtime receives a specially crafted network request, it fails to properly validate a pointer before dereferencing it. This leads to a NULL pointer dereference, which crashes the runtime process.

Root Cause: The runtime does not perform adequate input validation on certain fields within the communication protocol. An attacker can craft a request that causes the runtime to attempt to access memory at address 0x0 (NULL), resulting in an immediate segmentation fault.

Attack Vector: The attacker sends a malicious packet to the CODESYS Control runtime over the network. The runtime listens on default ports (e.g., 8080, 11740) for communication from engineering tools or other controllers.

Impact: Successful exploitation causes the runtime to crash, halting all control logic execution. This can lead to loss of control over industrial processes, safety system failures, and production downtime.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison cannot be provided. However, the vulnerable code pattern is a classic NULL pointer dereference:

Vulnerable Code (Conceptual):

void process_request(Packet *pkt) {
    // No validation of pkt->data pointer
    char *data = pkt->data;
    // Dereference without check
    int length = strlen(data); // NULL pointer dereference if data is NULL
    // ... rest of processing
}

Patched Code (Conceptual):

void process_request(Packet *pkt) {
    // Validate pointer before use
    if (pkt->data == NULL) {
        // Handle error gracefully
        return;
    }
    char *data = pkt->data;
    int length = strlen(data);
    // ... rest of processing
}

The fix would involve adding NULL checks before dereferencing any pointer obtained from the network packet.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running a vulnerable CODESYS Control runtime (e.g., CODESYS Control for Raspberry Pi, CODESYS Control Win, etc.)
• Network access to the target (default port 8080 or 11740)
• Knowledge of the CODESYS communication protocol (proprietary, but can be reverse-engineered)

Exploitation Steps:

1. Reconnaissance: Scan for CODESYS Control runtimes using Shodan or Nmap.

   nmap -p 8080,11740 --open <target>
   

2. Craft Malicious Packet: Using a tool like Scapy or a custom Python script, craft a packet that triggers the NULL pointer dereference. The exact packet structure is not publicly known, but it likely involves setting a specific field to NULL or an invalid value.
3. Send Packet: Send the crafted packet to the target.

   python3 exploit.py --target <IP> --port 8080
   

4. Verify DoS: The runtime should crash. Attempt to reconnect or check if the service is no longer responding.

Example Python Script (Conceptual):

import socket

def exploit(target, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target, port))
    # Crafted payload that triggers NULL pointer dereference
    payload = b"\x00" * 100  # Placeholder
    sock.send(payload)
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100", 8080)

Blue Team (Defensive)

Detection:

• Monitor for unexpected crashes of CODESYS Control runtime processes.
• Look for network traffic to/from CODESYS ports (8080, 11740) with malformed or unusual packet structures.
• Use the Sigma and Suricata rules provided in the Detection Engineering section.

Mitigation:

• Isolate CODESYS Control runtimes on a separate VLAN with strict firewall rules.
• Implement network segmentation to limit exposure to untrusted networks.
• Monitor for anomalous process terminations and restart the runtime automatically.
• Apply vendor patches as soon as they become available.

Indicators of Compromise (IOCs)

• Network:
  • Malformed packets on ports 8080 or 11740 targeting CODESYS Control runtimes.
  • Unexpected TCP connections to these ports from unknown IP addresses.
• Host:
  • CODESYS Control runtime process (e.g., CmpSrv.exe or CODESYSControl) crashing unexpectedly.
  • Event logs showing segmentation faults or access violations in the runtime process.
  • System logs indicating service termination (e.g., Event ID 7031 on Windows).
• File:
  • Crash dump files generated by the runtime (e.g., .dmp files in the runtime directory).

Detection Engineering

YARA Rule

rule CVE_2025_41691_CODESYS_NULL_PTR {
    meta:
        description = "Detects network packets targeting CODESYS Control runtime that may trigger CVE-2025-41691"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-41691"
    strings:
        $null_ptr_pattern = { 00 00 00 00 } // Placeholder for NULL pointer trigger
    condition:
        $null_ptr_pattern at 0
}

Sigma Rule

title: CVE-2025-41691 - CODESYS Control NULL Pointer Dereference DoS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation attempts of CVE-2025-41691 targeting CODESYS Control runtime
author: Valters IT
date: 2025/04/10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 8080
            - 11740
        EventID: 5156
    condition: selection
falsepositives:
    - Legitimate CODESYS engineering tool connections
level: high

Suricata Rule

alert tcp any any -> any 8080,11740 (msg:"CVE-2025-41691 - CODESYS Control NULL Pointer Dereference Attempt"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate CODESYS Control runtimes on a dedicated OT network segment with strict firewall rules. Block inbound traffic from untrusted networks to ports 8080 and 11740.
2. Access Control: Restrict network access to only trusted engineering workstations and controllers.
3. Monitoring: Implement the provided detection rules to identify potential exploitation attempts.
4. Backup: Ensure regular backups of runtime configurations and projects.

Long-Term Actions:

1. Vendor Patch: Monitor the CODESYS security advisory page for an official patch. Apply it as soon as it becomes available.
2. Update: Upgrade to the latest version of CODESYS Control runtime when a patched version is released.
3. Hardening: Disable unnecessary services and ports on the runtime device.
4. Incident Response: Develop and test an incident response plan for DoS attacks on critical OT systems.

Workaround (if patching is not possible):

• Implement an application-layer firewall or IPS that can inspect and block malformed CODESYS protocol packets.
• Use a VPN or jump host for all remote access to the OT network.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert