CVE-2026-44468

Vulnerability

The CODESYS Development System creates a temporary directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary bootstrap file that defines the components to be installed. The vulnerability affects the PackageManager and the IPM (Installation Package Manager) components [1]. No specific affected versions are disclosed in the reference.

Exploitation

A low-privileged local attacker can modify the temporary bootstrap file in the insecure directory. When the installer runs with elevated privileges, it processes the modified file, forcing the deployment of arbitrary components. This results in local privilege escalation.

Impact

Successful exploitation gives the attacker local privilege escalation, allowing execution of arbitrary code with administrative privileges. The attacker can fully compromise the system.

Mitigation

No mitigation is provided in the available reference [1]. Users should limit local access and monitor installation processes for suspicious activity. An update from CODESYS is expected but not yet released.