The CODESYS Development System 3.0.0.0 installs files by extracting them to a temporary directory that has incorrect default permissions. This misconfiguration enables a low-privileged local attacker to exploit a TOCTOU race condition during the installation process. By replacing verified installation files with malicious versions within the available time window, the attacker can escalate privileges locally. The vulnerability is classified under CWE-276 (Incorrect Default Permissions) and has a CVSS 4.0 score of 8.5, indicating high severity. There is currently no vendor-provided patch or official remediation guidance available.

Successful exploitation allows a low-privileged local attacker to escalate their privileges on the affected system by substituting installation files with malicious ones during the installation process. This can compromise system integrity and potentially lead to unauthorized administrative control. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and avoid running administrative installations in untrusted environments. Monitor vendor communications for updates on patches or official mitigations.