Attack Chain

1. The attacker gains low-privileged network access to the CODESYS Control runtime system.
2. The attacker exploits CVE-2025-41660 to initiate the boot application replacement process. This likely involves sending a crafted request to a specific network service exposed by the CODESYS runtime.
3. The attacker uploads a malicious boot application to the CODESYS Control runtime system.
4. The system validates (or fails to properly validate) the new boot application.
5. The CODESYS Control runtime system reboots and loads the malicious boot application.
6. The malicious boot application executes arbitrary code on the system, granting the attacker control.
7. The attacker can now manipulate industrial control processes, potentially causing damage or disruption.

Impact

Successful exploitation of CVE-2025-41660 allows a low-privileged attacker to gain complete control over the CODESYS Control runtime system. This could lead to disruption of industrial control processes, data theft, or physical damage to equipment. The CODESYS platform is used in a wide range of industries, including manufacturing, energy, and infrastructure, so the potential impact is significant.

Recommendation

• Apply available patches or updates from CODESYS to address CVE-2025-41660 as soon as they are released.
• Monitor network traffic to CODESYS Control runtime systems for suspicious activity related to boot application replacement. Consider deploying the Sigma rules below.
• Implement network segmentation to limit access to CODESYS Control runtime systems from untrusted networks.
• Review and enforce strong authentication and authorization policies for CODESYS Control runtime systems.