Historical intelligence backfill. This assessment covers reporting originally published on 2026-04-23 and was added to the RWP archive on 2026-09-07.
CODESYS Service credentials were enough to swap the boot application for a root backdoor
Nozomi, 23 April 2026 — CVE-2025-41658/41659/41660. Download app, steal crypto material, restore a tampered boot image. Runtime 4.21.0.0 / Toolkit 3.5.22.0 fix it. Authenticated, not pre-auth.
Bottom line up front
CONFIRMED Nozomi Labs, 23 April 2026 — CODESYS Control runtime issues CVE-2025-41658 (local hash read, 5.5), CVE-2025-41659 (crypto material, 8.3), CVE-2025-41660 (tampered boot application restore, 8.8). Chain: Service-level auth → backup-download the running app → lift keys that make optional encryption/signing decorative → inject machine code → restore via the backup path → wait for operator restart or reboot → code runs as root because that is how the runtime is shipped → rewrite the user DB to Administrator. Fixes: Control Runtime 4.21.0.0 and Runtime Toolkit 3.5.22.0. MITRE ICS techniques Nozomi maps: T0839 Module Firmware, T0882 Theft of Operational Information. This is not unauthenticated. It is "the service account the vendor left you is the plant." In-the-wild: not claimed. Process impact: ASSESSED if that SoftPLC is actually in control; UNKNOWN as observed 2026 incidents.
Historical backfill of 23 April 2026 reporting; added 7 September 2026.
What happened
A permission model that let a low-priv service identity treat the boot application as a file it could export, mutate, and put back.
Why it mattered
CODESYS is the SoftPLC inside a long list of vendor skins. One runtime bug is many OEM advisories. If you only patch "the OEM name on the cabinet," you will miss the toolkit version.
Who / what was affected
Devices running vulnerable CODESYS Control / Toolkit trains. Conveyors, HVAC, pumps — Nozomi's examples, not a victim list.
Technical context
Force code signing where the fixed runtime requires it. Kill default Service passwords. Do not expose the programming port past the engineering VLAN.
Exploitation / threat status at the time
CONFIRMED three CVEs + vendor fixes.
REPORTED chain as Labs reconstructed it.
What defenders should have done
- Runtime ≥ 4.21.0.0 / Toolkit ≥ 3.5.22.0.
- Unique Service creds, no internet.
- Alert on boot-application restore events.
RWP assessment
Confidence: High. Pair with PLCnext — two May/April 2026 "role is root" papers, different stacks.
Defensive actions
- OEM bulletin hunt for "CODESYS" in the fine print.
- Engineering-account PAM.
- Do not call this ICS malware; it is a trust-boundary fail in the runtime.
Sources
- Nozomi Networks — Backdooring CODESYS applications via vulnerability chaining
- Industrial Cyber — Chained CODESYS flaws could allow root-level control
- Cybersecurity News — Attackers can backdoor CODESYS applications