Attackers Can Backdoor CODESYS Applications by Chaining Vulnerabilities

Multiple high-impact vulnerabilities in the widely used CODESYS Control runtime (CVE-2025-41658/41659/41660) let local or authenticated attackers extract password hashes and cryptographic material and restore tampered boot applications; chained together an attacker can upload a backdoored PLC application, obtain root/administrator control, and manipulate industrial processes. CODESYS released fixes (Control Runtime 4.21.0.0, Toolkit 3.5.22.0), enabled mandatory code signing by default, and the advisory recommends applying updates, enforcing network segmentation, and monitoring industrial traffic.