In Pilz PMC programming tool 3.x prior to 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.
pilz pmc