Medium severity · published Mar 18, 2025
CVE-2024-41975
CODESYS (Edge) Gateway for Windows insecure default
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
CODESYS Edge Gateway · CODESYS
before 3.5.21.0 · source: vendor
CG
CODESYS Gateway for Windows · CODESYS
before 3.5.21.0 · source: vendor