CVE-2021-34599 - CVE House
Back to Database
Status published High CVE-2021-34599

Improper Certificate Validation in CODESYS Git

Vulnerability Description

Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the server to which the connection is made is not properly verified, the server connection is vulnerable to a man-in-the-middle attack.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-34599

Credits & Attribution

No credits recorded in the NVD database.

References

More from CODESYS

View All →
CVE-2025-41739
CODESYS Control - Linux/QNX SysSocket flaw
Medium 5.9
CVE-2025-41738
CODESYS Control - Invalid type usage in visualization
High 7.5
CVE-2025-41700
CODESYS Development System - Deserialization of Untrusted Data
High 7.8
CVE-2025-41691
CODESYS Control DoS via Unauthenticated NULL Pointer Dereference
High 7.5
CVE-2025-41660
CODESYS Control Boot Application Replacement Enables Code Execution
High 8.8

Affected Vendor

Affected Software

CODESYS Git
Vulnerable Versions:
CODESYS Git

Timeline

Official Publish: December 1st, 2021
Last Modified: September 17th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-295

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1040 Network Sniffing
Collection
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact