CVE-2026-0393 Details
Description
The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolation of authentication data. The vulnerability affects only login operations within an active visualization session.
A vulnerability exists in CODESYS Visualization versions prior to 4.10.0.0, allowing low-privileged users to remotely access credentials entered by other users during simultaneous login sessions. This issue arises from inadequate separation of authentication data, affecting only active visualization sessions.
Users can update to CODESYS Visualization version 4.10.0.0. For projects using an affected version, the update requires recompiling the application and downloading it to the HMI or PLC. The CODESYS Development System and available add-ons can be installed via the CODESYS Installer or downloaded from the CODESYS Store. Additional update information is available on the CODESYS Update page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-07_vde-2026-052.json | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| codesys visualization | >= 1.0.0.0, < 4.10.0.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 21, 2026 | New CVE Received | [email protected] |