CVE-2021-21863

A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2021-21863

A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2021-21863

The TALOS report documents a deserialization vulnerability in CODESYS Development System 3.5.16–3.5.17. The flaw is in ComponentModel.Profile.FromFile(), which deserializes a profile via BinaryFormatter.Deserialize, a known unsafe pattern for untrusted input. This can lead to arbitrary code execu...