CVE-2021-21867

CODESYS Development System versions 3.5.16 and 3.5.17 contain an unsafe deserialization vulnerability in ObjectManager.plugin ObjectStream.ProfileByteArray. The ProfileByteArray setter uses BinaryFormatter.Deserialize on untrusted input, enabling a crafted project file to execute arbitrary comman...