← CVE Intelligence

CVE-2026-44469

Incorrect Default Permissions in CODESYS Development System PUBLISHED

Description (CNA)

The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation.

Affected (CNA)

Vendor / productVersions
CODESYS / CODESYS Development Systemaffected 3.0.0.0 before 3.5.22.20

CWE

CWE-276

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.