CVE-2024-41975 CODESYS (Edge) Gateway for Windows insecure default
Unauthenticated attackers can access limited PLC network information via insecure defaults in CODESYS Edge Gateway for Windows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41975?
CVE-2024-41975 is a medium-severity vulnerability in CODESYS Edge Gateway, published on 18 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs.
Weakness: CWE-1188
Which versions are affected by CVE-2024-41975?
How do I fix CVE-2024-41975?
No fix has been published for CVE-2024-41975 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-41975 being exploited?
There is no known exploitation of CVE-2024-41975 in the wild and no public exploit code.
Sources
Also known as GHSA-f9hf-p7m4-xh2g.