Security readout for executives and security teams
Plain-English summary
This CVE describes a NULL pointer dereference in several older CODESYS runtime products. In plain terms, affected software can hit an invalid memory condition and fail. The sources do not provide CVSS, attack requirements, or confirmed exploitation, so urgency depends on whether these industrial runtime components exist in production.
Executive priority
Prioritize confirmation of exposure rather than emergency response. Escalate quickly if the affected runtimes support production control processes, because availability failures in industrial environments can create operational disruption even when exploitation evidence is incomplete.
Technical view
CVE-2019-19789 affects CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54. The reported weakness is a NULL pointer dereference. Available sources do not state attack vector, privileges, user interaction, or full impact.
Likely exposure
Exposure is likely limited to environments running the named legacy CODESYS runtime components, especially industrial control, test, engineering, or Windows-based PLC runtime systems. The bundle does not identify specific downstream OEM products or CPEs.
Exploitation context
The source bundle does not cite public exploitation, proof-of-concept availability, or CISA KEV listing. Treat active exploitation as unconfirmed. A NULL pointer dereference most commonly raises availability concerns, but the exact operational consequence is not specified in the provided sources.
Researcher notes
The public record is sparse: no CVSS, CWE, CPEs, attack vector, privileges, or detailed impact are included in the bundle. Analysis should stay anchored to the named products and versions until the CODESYS advisory or vendor support provides more detail.
Mitigation direction
- Identify any deployments of the three named CODESYS runtime products.
- Upgrade affected components to the fixed versions or later where applicable.
- Review the CODESYS advisory for vendor-specific remediation guidance.
- Limit network exposure of legacy runtime systems pending remediation.
- Coordinate changes with operations teams before updating control environments.
Validation and detection
- Inventory CODESYS runtime names and versions across engineering and runtime hosts.
- Confirm SP Realtime NT is V2.3.7.28 or later.
- Confirm Runtime Toolkit 32 bit full is V2.4.7.54 or later.
- Confirm PLCWinNT is V2.4.7.54 or later.
- Document any compensating controls for systems that cannot be upgraded.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19789 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.codesys.com/CVE reference · x_refsource_MISC
- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12946&token=edd5d8e821edaf3189d36bb1cac1aa1bfc42351f&download=CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.