CVE-2026-35225

HIGH

Improper timeout handling in CODESYS EtherNetIP

Title source: cna

Description

An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter stack, preventing legitimate clients from establishing new connections.

References (2)

Scores

CVSS v4 8.7
EPSS 0.0014
EPSS Percentile 34.0%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Details

CWE
CWE-754
Status published
Products (1)
CODESYS/CODESYS EtherNetIP 1.0.0.0 - 4.9.0.0
Published Apr 23, 2026
Tracked Since Apr 23, 2026