The vulnerabilities of the ObjectManager plugin and ProfileInformation.ProfileData components of the PLACODESYS Development System application programming interface allow attackers to execute arbitrary commands.

🗓️ 22 May 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

ObjectManager plugin and ProfileInformation components in Placodesys API are vulnerable to deserialization flaws enabling command execution.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2021-21866	3 Aug 202100:28	–	circl
CNNVD	3s-smart Software Solutions CODESYS Development System代码问题漏洞	26 Jul 202100:00	–	cnnvd
CVE	CVE-2021-21866	2 Aug 202120:33	–	cve
Cvelist	CVE-2021-21866	2 Aug 202120:33	–	cvelist
EUVD	EUVD-2021-9037	3 Oct 202520:07	–	euvd
NVD	CVE-2021-21866	2 Aug 202121:15	–	nvd
OSV	CVE-2021-21866	2 Aug 202121:15	–	osv
Prion	Deserialization of untrusted data	2 Aug 202121:15	–	prion
Positive Technologies	PT-2021-7768 · 3S Smart Software Solutions · Codesys Development System	2 Aug 202100:00	–	ptsecurity
RedhatCVE	CVE-2021-21866	22 May 202521:30	–	redhatcve

Vulners

Node

schneider_electric ecostruxure_machine_expertRange<2.0.3

OR

schneider_electric eurotherm_e+plcRange≤1.3.0.1

OR

codesys_gmbh codesys_development_systemMatch3.5.16.0

OR

codesys_gmbh codesys_development_systemMatch3.5.17.0

Source	Link
customers	www.customers.codesys.com/index.phpeID=dumpFile&t=f&f=16805&token=ee583c498941d9fda86490bca98ff21928eec08a&download=
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2021-1303
se	www.se.com/ae/en/download/document/SEVD-2022-011-06/
vuldb	www.vuldb.com/ru/
web	www.web.nvd.nist.gov/view/vuln/detail
talosintelligence	www.talosintelligence.com/reports/TALOS-2021-1303

16 Dec 2025 00:00Current

7.8High risk

Vulners AI Score7.8

CVSS 27.2

CVSS 37.8

EPSS0.01671

ObjectManager plugin ProfileInformation ProfileData ProfileInformation FileData Placodesys API Deserialization flaws