Attackers Chain Flaws to Backdoor CODESYS Applications and Deploy Malicious Code

Nozomi Networks Labs disclosed three critical vulnerabilities in the CODESYS Control runtime that can be chained by a low-privileged authenticated attacker to extract credentials and cryptographic keys, modify PLC application backups (ZIP with weak CRC32), and restore backdoored applications that execute as root after reboot; CODESYS issued patches and mandatory code signing, and organizations are urged to patch, harden credentials, segment OT, and monitor for suspicious activity.