This vulnerability (CWE-772) in CODESYS Modbus TCP Server arises from missing release of resources after their effective lifetime due to a race condition in connection handling. An unauthenticated attacker can exploit this to exhaust TCP connections, leading to denial of service. The CVSS 4.0 score is 8.2 (high), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on availability. The affected version is 1.0.0.0. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation results in denial of service by exhausting all TCP connections on the CODESYS Modbus TCP Server, preventing legitimate clients from connecting. This impacts availability but does not require authentication or user interaction. There is no indication of confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting exposure of the CODESYS Modbus TCP Server to untrusted networks and monitoring for unusual connection patterns that may indicate exploitation attempts.