CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Fri, 27 Mar 26 12:00:00 +0000", "last_updated": "Fri, 27 Mar 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/03/26/cisa-adds-one-known-exploited-vulnerability-catalog", "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/03/26/cisa-adds-one-known-exploited-vulnerability-catalog", "summary": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Thu, 26 Mar 26 12:00:00 +0000", "last_updated": "Thu, 26 Mar 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-085-02", "title": "OpenCode Systems OC Messaging and USSD Gateway", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-085-02", "summary": "\nSuccessful exploitation of this vulnerability could allow an authenticated low-privileged user to gain access to SMS messages outside of their authorized tenant scope via a crafted company or tenant identifier parameter.
\nThe following versions of OpenCode Systems OC Messaging and USSD Gateway are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.1 | \nOpenCode Systems | \nOpenCode Systems OC Messaging and USSD Gateway | \nImproper Access Control | \n
OpenCode Systems Custom Messaging Gateway 6.32.2 contains a web access vulnerability allowing one authenticated user to gain access to another authenticated user's messages via a crafted identifier parameter.
\n\nMitigation
The vulnerability was identified by OpenCode Systems on January 5, 2026 and remediated on January 6, 2026 with the release of version 6.33.11.
Mitigation
For more information, contact OpenCode: https://opencode.com/about/contact-us
https://opencode.com/about/contact-us
Relevant CWE: CWE-284 Improper Access Control
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-26 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution.
\nThe following versions of PTC Windchill Product Lifecycle Management are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 10 | \nPTC | \nPTC Windchill Product Lifecycle Management | \nImproper Control of Generation of Code ('Code Injection') | \n
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.
\n\nMitigation
PTC is aware of the issue and is actively developing a fix. In the meantime, PTC recommends applying the recommended workaround. Until official patches are available, customers must take urgent steps to safeguard their environments. Specifically: Protect any publicly accessible Windchill systems
Vendor fix
While publicly accessible Windchill and FlexPLM systems are at higher risk and require immediate attention, PTC strongly recommends applying the mitigation steps to all deployments, regardless of Internet exposure
Vendor fix
Apply the same precautions to FlexPLM deployments
Vendor fix
The following Apache and IIS HTTP Server configuration update should be IMMEDIATELY applied to every Windchill or FlexPLM system: Customers using Apache HTTP Server should only follow \"Apache HTTP Server Configuration \u2013 Workaround Steps\" section steps
Mitigation
Customers using Microsoft IIS should only follow \"IIS Configuration - Workaround Steps\" section steps
Mitigation
Please explicitly note that the same mitigation steps must also be applied on File Server / Replica Server configurations where applicable
Mitigation
For Windchill releases prior to 11.0 M030, workarounds may need to be altered to apply to unsupported previous releases
Mitigation
For Apache HTTP Server and IIS configuration workaround steps, please refer to the official advisory at:https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability.
https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability
Mitigation
If immediate remediation is not feasible, additional guidance and remediation options are available:https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability.
https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability
Relevant CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n10 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-26 | \n1 | \nInitial Republication of PTC's CS466318 | \n
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.
\nThe following versions of WAGO GmbH & Co. KG Industrial Managed Switches are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 10 | \nWAGO | \nWAGO GmbH & Co. KG Industrial Managed Switches | \nHidden Functionality | \n
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.
\n\nMitigation
WAGO has identified the following specific workarounds and mitigations users can apply to reduce risk: Product Group: WAGO Firmware installed on WAGO Hardware 852-1812, WAGO Firmware installed on WAGO Hardware 852-1813, WAGO Firmware installed on WAGO Hardware 852-1813/000-001, WAGO Firmware installed on WAGO Hardware 852-1816, WAGO Firmware installed on WAGO Hardware 852-303, WAGO Firmware installed on WAGO Hardware 852-1305, WAGO Firmware installed on WAGO Hardware 852-1305/000-001, WAGO Firmware installed on WAGO Hardware 852-1505/000-001, WAGO Firmware installed on WAGO Hardware 852-1505, WAGO Firmware installed on WAGO Hardware 852-602, WAGO Firmware installed on WAGO Hardware 852-603, WAGO Firmware installed on WAGO Hardware 852-1605, WAGO Firmware installed on WAGO Hardware 852-1812/010-000, WAGO Firmware installed on WAGO Hardware 852-1813/010-000, WAGO Firmware installed on WAGO Hardware 852-1816/010-000, WAGO Firmware installed on WAGO Hardware 852-602, WAGO Firmware installed on WAGO Hardware 852-603, WAGO Firmware installed on WAGO Hardware 852-1505, WAGO Firmware installed on WAGO Hardware 852-1305, WAGO Firmware installed on WAGO Hardware 852-1305/000-001, WAGO Firmware installed on WAGO Hardware 852-1505/000-001, WAGO Firmware installed on WAGO Hardware 852-1812, WAGO Firmware installed on WAGO Hardware 852-1813, WAGO Firmware installed on WAGO Hardware 852-1816, WAGO Firmware installed on WAGO Hardware 852-1812/010-000, WAGO Firmware installed on WAGO Hardware 852-1813/010-000, WAGO Firmware installed on WAGO Hardware 852-1816/010-000, WAGO Firmware installed on WAGO Hardware 852-1813/000-001, WAGO Firmware installed on WAGO Hardware 852-1605, WAGO Firmware installed on WAGO Hardware 852-303, WAGO Firmware installed on WAGO Hardware 852-1813/010-001, WAGO Firmware installed on WAGO Hardware 852-1813/010-001): Please update your devices to the specified fixed Firmware version.
Mitigation
Lean Managed Switch 852-1812, Lean Managed Switch 852-1813, Lean Managed Switch 852-1813/000-001, Lean Managed Switch 852-1816, Lean Managed Switch 852-1812/010-000, Lean Managed Switch 852-1813/010-000, Lean Managed Switch 852-1816/010-000, Lean Managed Switch 852-1813/010-001: To eliminate the attack vector deactivate ssh and telnet on the device.
Mitigation
Industrial Managed Switch 852-303, Industrial Managed Switch 852-1305, Industrial Managed Switch 852-1305/000-001, Industrial Managed Switch 852-1505/000-001, Industrial Managed Switch 852-1505, Industrial Managed Switch 852-602, Industrial Managed Switch 852-603, Industrial Managed Switch 852-1605: To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
Mitigation
The following product versions have been fixed: Firmware V1.2.1.S1 installed on Lean Managed Switch 852-1812 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.1.S1 installed on Lean Managed Switch 852-1813 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.3.S1 installed on Lean Managed Switch 852-1813/000-001 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.1.S1 installed on Lean Managed Switch 852-1816 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.8.S1 installed on Industrial Managed Switch 852-303 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.0.S1 installed on Industrial Managed Switch 852-1305 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.0.S1 installed on Industrial Managed Switch 852-1305/000-001 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.0.S1 installed on Industrial Managed Switch 852-1505/000-001 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.1.9.S1 installed on Industrial Managed Switch 852-1505 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.0.6.S1 installed on Industrial Managed Switch 852-602 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.0.6.S1 installed on Industrial Managed Switch 852-603 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.5.S1 installed on Industrial Managed Switch 852-1605 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.1.S1 installed on Lean Managed Switch 852-1812/010-000 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.1.S1 installed on Lean Managed Switch 852-1813/010-000 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.1.S1 installed on Lean Managed Switch 852-1816/010-000 are fixed versions for CVE-2026-3587
Mitigation
Firmware V1.2.1.S1 installed on Lean Managed Switch 852-1813/010-001 are fixed versions for CVE-2026-3587
Mitigation
For more information see the associated WAGO GmbH & Co. KG security advisory VDE-2026-020 WAGO PSIRT: https://www.wago.com/de-en/automation-technology/psirt. VDE-2026-020: WAGO: Vulnerability in managed switches - HTML: https://certvde.com/en/advisories/VDE-2026-020. VDE-2026-020: WAGO: Vulnerability in managed switches - CSAF: https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-020.json.
https://www.wago.com/de-en/automation-technology/psirt
Mitigation
For more information see the associated WAGO GmbH & Co. KG security advisory VDE-2026-020 WAGO PSIRT: https://www.wago.com/de-en/automation-technology/psirt. VDE-2026-020: WAGO: Vulnerability in managed switches - HTML: https://certvde.com/en/advisories/VDE-2026-020. VDE-2026-020: WAGO: Vulnerability in managed switches - CSAF: https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-020.json.
https://certvde.com/en/advisories/VDE-2026-020
Mitigation
For more information see the associated WAGO GmbH & Co. KG security advisory VDE-2026-020 WAGO PSIRT: https://www.wago.com/de-en/automation-technology/psirt. VDE-2026-020: WAGO: Vulnerability in managed switches - HTML: https://certvde.com/en/advisories/VDE-2026-020. VDE-2026-020: WAGO: Vulnerability in managed switches - CSAF: https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-020.json.
https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-020.json
Relevant CWE: CWE-912 Hidden Functionality
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n10 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-26 | \n1 | \nInitial Republication of WAGO GmbH & Co. KG VDE-2026-020 | \n
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Wed, 25 Mar 26 12:00:00 +0000", "last_updated": "Wed, 25 Mar 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-083-01", "title": "Pharos Controls Mosaic Show Controller", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-083-01", "summary": "\nSuccessful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary commands with root privileges.
\nThe following versions of Pharos Controls Mosaic Show Controller are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nPharos Controls | \nPharos Controls Mosaic Show Controller | \nMissing Authentication for Critical Function | \n
A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow an unauthenticated attacker to bypass authentication and execute arbitrary commands with root privileges.
\n\nMitigation
Pharos Controls recommends that users upgrade Mosaic Show Controller to version 2.16 or later.
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-24 | \n1 | \nInitial Publication | \n
Successful exploitation of these vulnerabilities could risk privilege escalation, which could result in remote code execution.
\nThe following versions of Schneider Electric Plant iT/Brewmaxx are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.9 | \nSchneider Electric | \nSchneider Electric Plant iT/Brewmaxx | \nUse After Free, Integer Overflow or Wraparound, Improper Control of Generation of Code ('Code Injection') | \n
The affected product uses Redis, an open-source, in-memory database. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution.
\n\nMitigation
Schneider Electric recommends users immediately apply the following mitigations to reduce the risk of exploit:
Mitigation
Install Patch ProLeiT-2025-001 via ProLeiT Support
https://www.proleit.com/support/
Mitigation
After installing ProLeiT-2025-001, disable the eval commands in Redis on the application server, VisuHub, engineering workstations, and workstations with emergency mode functionality
Mitigation
Force usage of secure Redis configuration templates in system settings as documented in the patch manual
Mitigation
Restart all patched servers and workstations
Mitigation
Schneider Electric strongly recommends the following industry cybersecurity best practices.
Mitigation
Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
Mitigation
Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
Mitigation
Place all controllers in locked cabinets and never leave them in the \"Program\" mode.
Mitigation
Never connect programming software to any network other than the network intended for that device.
Mitigation
Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
Mitigation
Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
Mitigation
Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
Mitigation
When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
Mitigation
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
https://www.se.com/us/en/download/document/7EN52-0390/
Vendor fix
For more information, see Schneider Electric security notification \"SEVD-2026-013-01 Multiple Third-Party Vulnerabilities on ProLeiT Plant iT/Brewmaxx\"
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-01.pdf
Relevant CWE: CWE-416 Use After Free
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.9 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | \n
The affected product uses Redis, an open-source, in-memory database. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution
\n\nMitigation
Schneider Electric recommends users immediately apply the following mitigations to reduce the risk of exploit:
Mitigation
Install Patch ProLeiT-2025-001 via ProLeiT Support
https://www.proleit.com/support/
Mitigation
After installing ProLeiT-2025-001, disable the eval commands in Redis on the application server, VisuHub, engineering workstations, and workstations with emergency mode functionality
Mitigation
Force usage of secure Redis configuration templates in system settings as documented in the patch manual
Mitigation
Restart all patched servers and workstations
Mitigation
Schneider Electric strongly recommends the following industry cybersecurity best practices.
Mitigation
Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
Mitigation
Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
Mitigation
Place all controllers in locked cabinets and never leave them in the \"Program\" mode.
Mitigation
Never connect programming software to any network other than the network intended for that device.
Mitigation
Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
Mitigation
Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
Mitigation
Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
Mitigation
When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
Mitigation
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
https://www.se.com/us/en/download/document/7EN52-0390/
Vendor fix
For more information, see Schneider Electric security notification \"SEVD-2026-013-01 Multiple Third-Party Vulnerabilities on ProLeiT Plant iT/Brewmaxx\"
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-01.pdf
Relevant CWE: CWE-190 Integer Overflow or Wraparound
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
The affected product uses Redis, an open-source, in-memory database. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user.
\n\nMitigation
Schneider Electric recommends users immediately apply the following mitigations to reduce the risk of exploit:
Mitigation
Install Patch ProLeiT-2025-001 via ProLeiT Support
https://www.proleit.com/support/
Mitigation
After installing ProLeiT-2025-001, disable the eval commands in Redis on the application server, VisuHub, engineering workstations, and workstations with emergency mode functionality
Mitigation
Force usage of secure Redis configuration templates in system settings as documented in the patch manual
Mitigation
Restart all patched servers and workstations
Mitigation
Schneider Electric strongly recommends the following industry cybersecurity best practices.
Mitigation
Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
Mitigation
Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
Mitigation
Place all controllers in locked cabinets and never leave them in the \"Program\" mode.
Mitigation
Never connect programming software to any network other than the network intended for that device.
Mitigation
Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
Mitigation
Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
Mitigation
Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
Mitigation
When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
Mitigation
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
https://www.se.com/us/en/download/document/7EN52-0390/
Vendor fix
For more information, see Schneider Electric security notification \"SEVD-2026-013-01 Multiple Third-Party Vulnerabilities on ProLeiT Plant iT/Brewmaxx\"
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-01.pdf
Relevant CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N | \n
The affected product uses Redis, an open-source, in-memory database. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service.
\n\nMitigation
Schneider Electric recommends users immediately apply the following mitigations to reduce the risk of exploit:
Mitigation
Install Patch ProLeiT-2025-001 via ProLeiT Support
https://www.proleit.com/support/
Mitigation
After installing ProLeiT-2025-001, disable the eval commands in Redis on the application server, VisuHub, engineering workstations, and workstations with emergency mode functionality
Mitigation
Force usage of secure Redis configuration templates in system settings as documented in the patch manual
Mitigation
Restart all patched servers and workstations
Mitigation
Schneider Electric strongly recommends the following industry cybersecurity best practices.
Mitigation
Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
Mitigation
Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
Mitigation
Place all controllers in locked cabinets and never leave them in the \"Program\" mode.
Mitigation
Never connect programming software to any network other than the network intended for that device.
Mitigation
Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
Mitigation
Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
Mitigation
Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
Mitigation
When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
Mitigation
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
https://www.se.com/us/en/download/document/7EN52-0390/
Vendor fix
For more information, see Schneider Electric security notification \"SEVD-2026-013-01 Multiple Third-Party Vulnerabilities on ProLeiT Plant iT/Brewmaxx\"
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-01.pdf
Relevant CWE: CWE-190 Integer Overflow or Wraparound
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.3 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-24 | \n1 | \nInitial Republication of SEVD-2026-013-01 | \n
Schneider Electric is aware of a vulnerability in its EcoStruxure Foxboro DCS Control Software on Foxboro DCS workstations and servers. Control Core Services and all runtime software, like FCPs, FDCs, and FBMs, are not affected. The EcoStruxure Foxboro DCS ([https://www.se.com/ww/en/product-range/63680-ecostruxure-foxboro-dcs/](https://www.se.com/ww/en/product-range/63680-ecostruxure-foxboro-dcs/)) product is an innovative family of fault-tolerant, highly available control components, which consolidates critical information and elevates staff capabilities to ensure flawless, continuous plant operation. Failure to apply the remediation provided below may risk deserialization of untrusted data, which could result in loss of confidentiality, integrity and potential remote code execution on the compromised workstation.
\nThe following versions of Schneider Electric EcoStruxure Foxboro DCS are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 6.5 | \nSchneider Electric | \nSchneider Electric EcoStruxure Foxboro DCS | \nDeserialization of Untrusted Data | \n
A deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when an admin authenticated user opens a malicious project file.
\n\nVendor fix
Version CS 8.1 of EcoStruxure Foxboro DCS includes a fix for this vulnerability and is available through [https://buyautomation.se.com/](https://buyautomation.se.com/) CS 8.1 requires FX-V3 licenses, standard upgrade procedures apply. A reboot is required for workstations and servers. Depending on the existing system version, online upgrade without production interruption might be possible. Schneider Electric recommends you work with your local field service representative or technical service consultant for further information.
https://buyautomation.se.com/
Mitigation
If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: The vulnerability is attacked with manipulated data from external sources to the DCS computers. Examples for these are: * Configuration taglists * DirectAccess Scripts * Any partial or full Galaxy backups * Library files * Code snippets * ASCII files of any sort * Generally, any file getting from outside the DCS computer on a DCS computer. Only use data from trusted sources, check for correct file name endings on data files, check for reasonable file sizes for any files coming to the system, and check structured data for any fields or columns which might be unexpected. Check for unusual manipulations of data within data files and reject files containing unexpected data or structures. Use secure communication channels and encrypt communications when communicating outside the site network. Avoid and ban removable media (e.g. USB sticks or drives) Minimize count of users with engineering or administrative rights to DCS computers and ensure all interactions on DCS computers are executed with minimal user access rights. Consequently, isolating Foxboro DCS computers will help minimizing the risk of this vulnerability being exploited.
Relevant CWE: CWE-502 Deserialization of Untrusted Data
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | \n
Schneider Electric strongly recommends the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ * Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. * Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks. * Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode. * Never connect programming software to any network other than the network intended for that device. * Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks. * Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation. * Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet. * When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
\nThis document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric\u2019s products, visit the company\u2019s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
\nTHIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION
\nSchneider's purpose is to create impact by empowering all to make the most of our energy and resources, bridging progress and sustainability for all. We call this Life Is On. Our mission is to be the trusted partner in sustainability and efficiency. We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled industrial IoT solutions with connected products, automation, software and services, delivering digital twins to enable profitable growth for our customers. We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our meaningful purpose of a sustainable future for all. www.se.com
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Schneider Electric SEVD-2026-069-03 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-10 | \n1 | \nOriginal Release | \n
| 2026-03-13 | \n2 | \nUpdated remediation and mitigations section. | \n
| 2026-03-24 | \n3 | \nInitial CISA Republication of Schneider Electric Security Notification SEVD-2026-069-03 | \n
Successful exploitation of this vulnerability could allow an attacker to send a specially crafted file, and when parsed, could result in a denial-of-service condition.
\nThe following versions of Grassroots DICOM (GDCM) are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nGrassroots | \nGrassroots DICOM (GDCM) | \nMissing Release of Memory after Effective Lifetime | \n
A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-standard VR types in file meta information. The vulnerability leads to vast memory allocations and resource depletion, triggering a denial-of-service condition. A maliciously crafted file can fill the heap in a single read operation without properly releasing it.
\n\nMitigation
The maintainer of Grassroots DICOM (GDCM) has not responded to requests to work with CISA to mitigate this vulnerability. For update information refer to the software page on SourceForge.
Mitigation
https://sourceforge.net/projects/gdcm/.
https://sourceforge.net/projects/gdcm/
Relevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-24 | \n1 | \nInitial Publication. | \n
CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Fri, 20 Mar 26 12:00:00 +0000", "last_updated": "Fri, 20 Mar 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/resources-tools/resources/russian-intelligence-services-target-commercial-messaging-application-accounts", "title": "Russian Intelligence Services Target Commercial Messaging Application Accounts", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/resources-tools/resources/russian-intelligence-services-target-commercial-messaging-application-accounts", "summary": "CISA and the Federal Bureau of Investigation released a Public Service Announcement (PSA) warning about ongoing phishing campaigns by cyber actors associated with the Russian Intelligence Services targeting commercial messaging applications (CMAs). These campaigns aim to bypass encryption to compromise to individual user accounts with targets including current and former U.S. government officials, military personnel, political figures, and journalists.
\nEvidence shows that cyber actors have been able to compromise individual CMA accounts, but not encryption of the applications themselves. The actors\u2019 global campaigns have resulted in unauthorized access to thousands of individual CMA accounts to view the victims\u2019 messages and contact lists, send messages, and conduct additional phishing against other CMA accounts.
\nCISA and FBI urge CMA users to review the PSA, follow recommended cybersecurity practices, and remain vigilant for suspicious activity.
", "summary_is_html": true, "first_seen": "Fri, 20 Mar 26 12:00:00 +0000", "last_updated": "Fri, 20 Mar 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-06", "title": "CTEK Chargeportal", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-06", "summary": "\nSuccessful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.
\nThe following versions of CTEK Chargeportal are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.4 | \nCTEK | \nCTEK Chargeportal | \nMissing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials | \n
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
\n\nMitigation
CTEK will be sunsetting this product in April 2026. Please contact CTEK for more information https://www.ctek.com/support.
https://www.ctek.com/support
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.4 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L | \n
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.
\n\nMitigation
CTEK will be sunsetting this product in April 2026. Please contact CTEK for more information https://www.ctek.com/support.
https://www.ctek.com/support
Relevant CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
\n\nMitigation
CTEK will be sunsetting this product in April 2026. Please contact CTEK for more information https://www.ctek.com/support.
https://www.ctek.com/support
Relevant CWE: CWE-613 Insufficient Session Expiration
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.3 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | \n
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
\n\nMitigation
CTEK will be sunsetting this product in April 2026. Please contact CTEK for more information https://www.ctek.com/support.
https://www.ctek.com/support
Relevant CWE: CWE-522 Insufficiently Protected Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-19 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability may risk a Cross-site Scripting or an open redirect attack which could result in an account takeover scenario or the execution of code in the user browser.
\nThe following versions of Schneider Electric Modicon Controllers M241, M251, M258, and LMC058 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 5.4 | \nSchneider Electric | \nSchneider Electric Modicon Controllers M241, M251, M258, and LMC058 | \nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | \n
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim's browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.
\n\nMitigation
Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk: Modicon Controller M241 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M241 to the latest Firmware and perform reboot. For instructions refer to Modicon M241 Logic Controller, Programming Guide: https://www.se.com/ww/en/download/document/EIO0000003059/, https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER.
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/
Mitigation
Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk: Modicon Controller M241 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M241 to the latest Firmware and perform reboot. For instructions refer to Modicon M241 Logic Controller, Programming Guide: https://www.se.com/ww/en/download/document/EIO0000003059/, https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER.
https://www.se.com/ww/en/download/document/EIO0000005500/
Mitigation
Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk: Modicon Controller M241 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M241 to the latest Firmware and perform reboot. For instructions refer to Modicon M241 Logic Controller, Programming Guide: https://www.se.com/ww/en/download/document/EIO0000003059/, https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER.
https://www.se.com/ww/en/download/document/EIO0000003059/
Mitigation
Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk: Modicon Controller M241 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M241 to the latest Firmware and perform reboot. For instructions refer to Modicon M241 Logic Controller, Programming Guide: https://www.se.com/ww/en/download/document/EIO0000003059/, https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER.
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER
Mitigation
Modicon Controller M251 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M251 to the latest Firmware and perform reboot. For instructions refer to Modicon M251 Logic Controller, Programming Guide: https://www.se.com/us/en/download/document/EIO0000003089/, https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER.
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/
Mitigation
Modicon Controller M251 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M251 to the latest Firmware and perform reboot. For instructions refer to Modicon M251 Logic Controller, Programming Guide: https://www.se.com/us/en/download/document/EIO0000003089/, https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER.
https://www.se.com/ww/en/download/document/EIO0000005500/
Mitigation
Modicon Controller M251 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M251 to the latest Firmware and perform reboot. For instructions refer to Modicon M251 Logic Controller, Programming Guide: https://www.se.com/us/en/download/document/EIO0000003089/, https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER.
https://www.se.com/us/en/download/document/EIO0000003089/
Mitigation
Modicon Controller M251 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M251 to the latest Firmware and perform reboot. For instructions refer to Modicon M251 Logic Controller, Programming Guide: https://www.se.com/us/en/download/document/EIO0000003089/, https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER.
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER
Mitigation
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. Deactivate the Webserver after use when not needed. Use encrypted communication links. Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. Use VPN (Virtual Private Networks) tunnels if remote access is required. The \"Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\" provide product specific hardening guidelines: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242.
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242
Mitigation
Modicon Controllers M258 and Modicon Controllers LMC058: Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. Deactivate the Webserver after use when not needed. Use encrypted communication links. Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. Use VPN (Virtual Private Networks) tunnels if remote access is required. The \"Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\" provide product specific hardening guidelines: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242.
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242
Mitigation
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-069-02 Improper Neutralization in Multiple Products - PDF Version: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-02.pdf. Improper Neutralization in Multiple Products - SEVD-2026-069-02 CSAF Version: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-069-02.json.
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-02.pdf
Mitigation
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-069-02 Improper Neutralization in Multiple Products - PDF Version: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-02.pdf. Improper Neutralization in Multiple Products - SEVD-2026-069-02 CSAF Version: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-069-02.json.
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-069-02.json
Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.4 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-19 | \n1 | \nInitial Republication of Schneider Electric CPCERT SEVD-2026-069-02 | \n
Successful exploitation of these vulnerabilities could allow an attacker to read, intercept, or modify communications.
\nThe following versions of Automated Logic WebCTRL Premium Server are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.1 | \nAutomated Logic | \nAutomated Logic WebCTRL Premium Server | \nMultiple Binds to the Same Port, Authentication Bypass by Spoofing, Cleartext Transmission of Sensitive Information | \n
Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to craft and send malicious packets and impersonate the WebCTRL service without requiring code injection into the WebCTRL software.
\n\nMitigation
Automated Logic notes that WebCTRL 7 is End of Life (EOL) and has been out of support since January 27, 2023. Users are advised to upgrade to the latest version of the WebCTRL server application, which supports the more secure BACnet/SC.
Mitigation
For customers using supported versions of WebCTRL (WebCTRL 8.5 cumulative releases and later), Automated Logic provides secure configuration guidance for hardware and software deployments; BACnet Secure Connect (BACnet/SC) support, which introduces TLS encryption and mutual authentication; and published best practices for network segmentation, access control, and secure protocol implementation. Additional information is available at: https://www.automatedlogic.com/en/company/security-commitment/.
https://www.automatedlogic.com/en/company/security-commitment/
Relevant CWE: CWE-605 Multiple Binds to the Same Port
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.7 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | \n
WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or associated AutomatedLogic controllers. Spoofed packets may be processed as legitimate.
\n\nMitigation
Automated Logic notes that WebCTRL 7 is End of Life (EOL) and has been out of support since January 27, 2023. Users are advised to upgrade to the latest version of the WebCTRL server application, which supports the more secure BACnet/SC.
Mitigation
For customers using supported versions of WebCTRL (WebCTRL 8.5 cumulative releases and later), Automated Logic provides secure configuration guidance for hardware and software deployments; BACnet Secure Connect (BACnet/SC) support, which introduces TLS encryption and mutual authentication; and published best practices for network segmentation, access control, and secure protocol implementation. Additional information is available at: https://www.automatedlogic.com/en/company/security-commitment/.
https://www.automatedlogic.com/en/company/security-commitment/
Relevant CWE: CWE-290 Authentication Bypass by Spoofing
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. The proprietary format used by WebCTRL to receive updates from the PLC can also be sniffed and reverse engineered.
\n\nMitigation
Automated Logic notes that WebCTRL 7 is End of Life (EOL) and has been out of support since January 27, 2023. Users are advised to upgrade to the latest version of the WebCTRL server application, which supports the more secure BACnet/SC.
Mitigation
For customers using supported versions of WebCTRL (WebCTRL 8.5 cumulative releases and later), Automated Logic provides secure configuration guidance for hardware and software deployments; BACnet Secure Connect (BACnet/SC) support, which introduces TLS encryption and mutual authentication; and published best practices for network segmentation, access control, and secure protocol implementation. Additional information is available at: https://www.automatedlogic.com/en/company/security-commitment/.
https://www.automatedlogic.com/en/company/security-commitment/
Relevant CWE: CWE-319 Cleartext Transmission of Sensitive Information
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.1 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-19 | \n1 | \nInitial Publication | \n
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Thu, 19 Mar 26 12:00:00 +0000", "last_updated": "Thu, 19 Mar 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-01", "title": "Schneider Electric Modicon M241, M251, and M262", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-01", "summary": "\nSuccessful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition on the product.
\nThe following versions of Schneider Electric Modicon M241, M251, and M262 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 5.3 | \nSchneider Electric | \nSchneider Electric Modicon M241, M251, and M262 | \nImproper Resource Shutdown or Release | \n
CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.
\n\nMitigation
Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk: Modicon Controller M241 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M241 to the latest Firmware and perform reboot. For instructions refer to Modicon M241 Logic Controller, Programming Guide: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/.
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/
Mitigation
Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk: Modicon Controller M241 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M241 to the latest Firmware and perform reboot. For instructions refer to Modicon M241 Logic Controller, Programming Guide: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/.
https://www.se.com/ww/en/download/document/EIO0000005500/
Mitigation
Modicon Controller M251 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M251 to the latest Firmware and perform reboot. For instructions refer to Modicon M251 Logic Controller, Programming Guide: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/.
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/
Mitigation
Modicon Controller M251 Firmware version 5.4.13.12 delivered with EcoStruxure\u2122 Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M251 to the latest Firmware and perform reboot. For instructions refer to Modicon M251 Logic Controller, Programming Guide: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/.
https://www.se.com/ww/en/download/document/EIO0000005500/
Mitigation
Modicon Controller M262 Firmware version 5.4.10.12 delivered with EcoStruxure\u2122 Machine Expert v2.5 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M262 to the latest Firmware and perform reboot. For instructions refer to Modicon M262 Logic/Motion Controller, Programming Guide: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/.
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/
Mitigation
Modicon Controller M262 Firmware version 5.4.10.12 delivered with EcoStruxure\u2122 Machine Expert v2.5 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/. On the engineering workstation install v2.5.0.1 of EcoStruxure\u2122 Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/. Update Modicon Controller M262 to the latest Firmware and perform reboot. For instructions refer to Modicon M262 Logic/Motion Controller, Programming Guide: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/.
https://www.se.com/ww/en/download/document/EIO0000005500/
Mitigation
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-069-01 Improper Resource Shutdown or Release vulnerability in Multiple Products - SEVD-2026-069-01 PDF Version: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-01.pdf. Improper Resource Shutdown or Release vulnerability in Multiple Products - SEVD-2026-069-01 CSAF Version: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-069-01.json.
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-01.pdf
Mitigation
All affected products: If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. Filter ports and IP through the embedded firewall. Use encrypted communication links. Use VPN (Virtual Private Networks) tunnels if remote access is required. The \"Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\" provide product specific hardening guidelines: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242.
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242
Relevant CWE: CWE-404 Improper Resource Shutdown or Release
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-19 | \n1 | \nInitial Republication of Schneider Electric CPCERT SEVD-2026-069-01 | \n
Schneider Electric is aware of a vulnerability in its EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO) products. EcoStruxure Power Monitoring Expert (PME) is an on-premises software used to help power critical and energy-intensive facilities maximize uptime and operational efficiency. EcoStruxure Power Operation (EPO) are on-premises software offers that provides a single platform to monitor and control medium and lower power systems.Failure to apply the fix provided below may risk local arbitrary code execution, which could result in the local system being compromised, a disruption of operations, and/or unauthorized administrative control of the system.
\nThe following versions of Schneider Electric EcoStruxure PME and EPO are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.8 | \nSchneider Electric | \nSchneider Electric EcoStruxure PME and EPO | \nDeserialization of Untrusted Data | \n
A deserialization of untrusted data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
\n\nVendor fix
Hotfix_279338_Release_2024R2 is available for EcoStruxure Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric\u2019s Customer Care Center to download this hotfix. No reboot required.
Vendor fix
Customers should upgrade to EcoStruxure Power Monitoring Expert (PME) 2024 R3. Contact Schneider Electric\u2019s Customer Care Center for assistance.
Vendor fix
Hotfix_282807 - for 2023R2 is available for EcoStruxure Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric\u2019s Customer Care Center to download this hotfix. No reboot required.
Vendor fix
Customers should upgrade to EcoStruxure Power Monitoring Expert (PME) 2023 R2. Once upgraded, Hotfix_282807 - for 2023R2 is available for EcoStruxure Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric\u2019s Customer Care Center for assistance.
Vendor fix
Customers should upgrade to EcoStruxure Power Monitoring Expert (PME) 2023 R2. Once upgraded, Hotfix_282807 - for 2023R2 is available for EcoStruxure Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric\u2019s Customer Care Center for assistance.
No fix planned
EcoStruxure Power Monitoring Expert (PME) 2022 version has reached its end of life and is no longer supported. \u2022 Ensure your deployment of PME has followed the cybersecurity hardening guidelines provided with the product. https://product-help.schneider-electric.com/EcoStruxure/Power-Monitoring-Expert-2024/content/2_planning/cybersecurity/cyber-planningrecactions.htm \u2022 Ensure PME is running in an isolated network \u2022 Deploy and configure the Windows firewall to limit access to appropriate network segments\u2022 Enforce complex password policies.o Review Server Access Permissions o Conduct an audit of all Windows-authenticated users who currently have access to PME. Repeat this audit of your system periodically. o Identify all accounts with access rights, especially those with elevated privileges or remote access. o Limit access to essential users only.o Revoke access for any user accounts that are not critical for system functionality or daily operations.o Apply the principle of least privilege to ensure users have only the access necessary for their role(s). Customers should also consider upgrading to the latest product offering EcoStruxure Power Monitoring Expert (PME) 2024 R3 to resolve this issue.
https://product-help.schneider-electric.com/EcoStruxure/Power-Monitoring-Expert-2024/content/2_planning/cybersecurity/cyber-planningrecactions.htm
No fix planned
EcoStruxure Power Operation (EPO) 2022 version and EcoStruxure Power Monitoring Expert (PME) 2022 has reached its end of life and is no longer supported. \u2022 Ensure your deployment of PME has followed the cybersecurity hardening guidelines provided with the product. https://product-help.schneider-electric.com/EcoStruxure/Power-Monitoring-Expert-2024/content/2_planning/cybersecurity/cyber-planningrecactions.htm \u2022 Ensure PME is running in an isolated network \u2022 Deploy and configure the Windows firewall to limit access to appropriate network segments\u2022 Enforce complex password policies.o Review Server Access Permissions o Conduct an audit of all Windows-authenticated users who currently have access to PME. Repeat this audit of your system periodically. o Identify all accounts with access rights, especially those with elevated privileges or remote access. o Limit access to essential users only.o Revoke access for any user accounts that are not critical for system functionality or daily operations.o Apply the principle of least privilege to ensure users have only the access necessary for their role(s). Customers should also consider upgrading to the latest product offering EcoStruxure Power Monitoring Expert (PME) 2024 R3 to resolve this issue.
https://product-help.schneider-electric.com/EcoStruxure/Power-Monitoring-Expert-2024/content/2_planning/cybersecurity/cyber-planningrecactions.htm
Relevant CWE: CWE-502 Deserialization of Untrusted Data
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
Schneider Electric strongly recommends the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ * Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. * Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks. * Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode. * Never connect programming software to any network other than the network intended for that device. * Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks. * Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation. * Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet. * When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
\nThis document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric\u2019s products, visit the company\u2019s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
\nTHIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION
\nSchneider's purpose is to create impact by empowering all to make the most of our energy and resources, bridging progress and sustainability for all. We call this Life Is On. Our mission is to be the trusted partner in sustainability and efficiency. We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled industrial IoT solutions with connected products, automation, software and services, delivering digital twins to enable profitable growth for our customers. We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our meaningful purpose of a sustainable future for all. www.se.com
\nEcoStruxure Power Operation 2022 with Advanced Reporting AND EcoStruxure Power Operation 2024 with Advanced Reporting utilizes EcoStruxure Power Monitoring Expert. You must update EcoStruxure Power Monitoring Expert separately from EcoStruxure Power Operation and apply the appropriate update for Power Monitoring Expert as described above.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Schneider Electric SEVD-2026-069-06 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-10 | \n1 | \nOriginal Release | \n
| 2026-03-19 | \n2 | \nInitial CISA Republication of Schneider Electric SEVD-2026-069-06 advisory | \n
Schneider Electric is aware of a vulnerability in its EcoStruxure\u2122 Automation Expert product. The EcoStruxure\u2122 Automation Expert product is plant automation software designed for digital control systems in discrete, hybrid and continuous industrial processes. A totally integrated automation solution designed to enhance your flexibility, efficiency and scalability. Failure to apply the remediation provided below may risk execution of arbitrary commands on the engineering workstation, which could result in a potential compromise of full system.
\nThe following versions of Schneider Electric EcoStruxure Automation Expert are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.2 | \nSchneider Electric | \nSchneider Electric EcoStruxure Automation Expert | \nImproper Control of Generation of Code ('Code Injection') | \n
CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on the engineering workstation which could result in a limited compromise of the workstation and a potential loss of Confidentiality, Integrity and Availability of the subsequent system when an authenticated user opens a malicious project file.
\n\nVendor fix
Version v25.0.1 of EcoStruxure\u2122 Automation Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/23643079-ecostruxure-automation-expert/
https://www.se.com/ww/en/product-range/23643079-ecostruxure-automation-expert/
Mitigation
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Solution and archive files must be stored within the user\u2019s home directory or in any location protected by appropriate Windows file\u2011system access controls to prevent unauthorized access in multi\u2011user environments. Users who choose to store files outside their home directory are responsible for applying restrictive Windows permissions to secure those locations. Before opening any solution or archive file, users are required to verify its authenticity and ensure that it has not been modified by unauthorized users. For detailed mitigation steps, refer to the User Manual - https://product-help.se.com/EcoStruxure%20Automation%20Expert/25.0/Offer%20Guides/en-US/EAE_UM?t=EAE_UM%2FSolutionIntegrity-FE037ED3.html%3Frhhlterm%3Dundefined%253Frhsearch%253Dundefined&theme=Help
https://product-help.se.com/EcoStruxure%20Automation%20Expert/25.0/Offer%20Guides/en-US/EAE_UM?t=EAE_UM%2FSolutionIntegrity-FE037ED3.html%3Frhhlterm%3Dundefined%253Frhsearch%253Dundefined&theme=Help
Relevant CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.2 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H | \n
We strongly recommend the following industry cybersecurity best practices. * Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. * Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks. * Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode. * Never connect programming software to any network other than the network intended for that device. * Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks. * Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation. * Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.
\nThis document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
\nTHIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION
\nSchneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and sustainability for all. We call this Life Is On. Our mission is to be the trusted partner in Sustainability and Efficiency. We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation, software and services, delivering digital twins to enable profitable growth for our customers. We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our meaningful purpose of a sustainable future for all. www.se.com
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Schneider Electric CPCERT SEVD-2026-069-04 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric CPCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-10 | \n1 | \nOriginal Release | \n
| 2026-03-19 | \n2 | \nInitial CISA Republication of Schneider Electric CPCERT SEVD-2026-069-04 advisory | \n
Successful exploitation of this vulnerability could allow a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition in the affected products.
\nThe following versions of Mitsubishi Electric CNC Series are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 5.9 | \nMitsubishi Electric | \nMitsubishi Electric CNC Series | \nImproper Validation of Specified Index, Position, or Offset in Input | \n
Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) vulnerability in the affected products allows a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition in the affected products by sending specially crafted packets to TCP port 683.
\n\nVendor fix
Please apply the fixed version (BC or later) for Mitsubishi Electric M800VW(BND-2051W000), M800VS(BND-2052W000), M80V(BND-2053W000), and M80VW(BND-2054W000). For instructions on how to apply it, please consult your Mitsubishi Electric representative.
Vendor fix
Please apply the fixed version (FN or later) for Mitsubishi Electric M800W(BND-2005W000), M800S(BND-2006W000), M80(BND-2007W000), M80W(BND-2008W000), and E80(BND-2009W000). For instructions on how to apply it, please consult your Mitsubishi Electric representative.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using a firewall or virtual private network (VPN) to prevent unauthorized access, when internet access is required, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using the product within a LAN and blocking access from untrusted networks and hosts through a firewall, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using IP filters to prevent unauthorized access, when internet access is required, to minimize the risk of exploiting this vulnerability. IP filter function is available for M800V/M80V Series and M800/M80/E80 Series. For details about the IP filter function, refer to the following manual for each product: M800V/M80V Series Instruction Manual \"16. Appendix 3 IP Address Filter Setting Function\", M800/M80/E80 Series Instruction Manual \"15. Appendix 2 IP Address Filter Setting Function\"
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the affected product and to all computers and network devices to which the products are connected, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends installing anti-virus software on PCs that can access the affected product, to minimize the risk of exploiting this vulnerability.
Mitigation
For more information, see Mitsubishi Electric 2025-022. https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-022_en.pdf
https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-022_en.pdf
Relevant CWE: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.9 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of CISA V20250121-001#02 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact CISA directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-19 | \n1 | \nInitial CISA Republication of Mitsubishi Electric security advisory 2025-022 | \n
Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.
\nThe following versions of IGL-Technologies eParking.fi are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.4 | \nIGL-Technologies | \nIGL-Technologies eParking.fi | \nMissing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials | \n
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
\n\nMitigation
IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls:
1) Enforce modern security profiles and stronger authentication.
2) Device\u2011level whitelisting was implemented to ensure that only authorized charging units can connect.
3) Rate\u2011limiting controls prevent excessive requests and reduces DoS risk.
4) Enhanced automated monitoring and alerting to detection abnormal network activity.
Devices using the encrypted deployment of eParking's OCPP servers or IGL-Technologies proprietary eTolppa protocol are not impacted by these vulnerabilities.
Mitigation
To prevent this in the future IGL-Technologies will continue vulnerability monitoring under their ISO\u202f27001:2022 security program and tighten security requirements for future third\u2011party OCPP hardware approvals.
Mitigation
For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.
mailto:security@igl.fi
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.4 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L | \n
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.
\n\nMitigation
IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls:
1) Enforce modern security profiles and stronger authentication.
2) Device\u2011level whitelisting was implemented to ensure that only authorized charging units can connect.
3) Rate\u2011limiting controls prevent excessive requests and reduces DoS risk.
4) Enhanced automated monitoring and alerting to detection abnormal network activity.
Mitigation
Devices using the encrypted deployment of eParking's OCPP servers or IGL-Technologies proprietary eTolppa protocol are not impacted by these vulnerabilities.
Mitigation
To prevent this in the future IGL-Technologies will continue vulnerability monitoring under their ISO\u202f27001:2022 security program and tighten security requirements for future third\u2011party OCPP hardware approvals.
Mitigation
For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.
mailto:security@igl.fi
Relevant CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
\n\nMitigation
IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls:
1) Enforce modern security profiles and stronger authentication.
2) Device\u2011level whitelisting was implemented to ensure that only authorized charging units can connect.
3) Rate\u2011limiting controls prevent excessive requests and reduces DoS risk.
4) Enhanced automated monitoring and alerting to detection abnormal network activity.
Mitigation
Devices using the encrypted deployment of eParking's OCPP servers or IGL-Technologies proprietary eTolppa protocol are not impacted by these vulnerabilities.
Mitigation
To prevent this in the future IGL-Technologies will continue vulnerability monitoring under their ISO\u202f27001:2022 security program and tighten security requirements for future third\u2011party OCPP hardware approvals.
Mitigation
For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.
mailto:security@igl.fi
Relevant CWE: CWE-613 Insufficient Session Expiration
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.3 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | \n
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
\n\nMitigation
IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls:
1) Enforce modern security profiles and stronger authentication.
2) Device\u2011level whitelisting was implemented to ensure that only authorized charging units can connect.
3) Rate\u2011limiting controls prevent excessive requests and reduces DoS risk.
4) Enhanced automated monitoring and alerting to detection abnormal network activity.
Mitigation
Devices using the encrypted deployment of eParking's OCPP servers or IGL-Technologies proprietary eTolppa protocol are not impacted by these vulnerabilities.
Mitigation
To prevent this in the future IGL-Technologies will continue vulnerability monitoring under their ISO\u202f27001:2022 security program and tighten security requirements for future third\u2011party OCPP hardware approvals.
Mitigation
For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.
mailto:security@igl.fi
Relevant CWE: CWE-522 Insufficiently Protected Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-19 | \n1 | \nInitial Publication | \n
CISA is aware of malicious cyber activity targeting endpoint management systems of U.S. organizations based on the March 11, 2026 cyberattack against U.S.-based medical technology firm Stryker Corporation, which affected their Microsoft environment.1 To defend against similar malicious cyber activity, CISA urges organizations to harden endpoint management system configurations using the recommendations and resources provided in this alert. CISA is conducting enhanced coordination with federal partners, including the Federal Bureau of Investigation (FBI), to identify additional threats and determine mitigation actions.
\nTo defend against similar malicious activity that misuses legitimate endpoint management software, CISA urges organizations to implement Microsoft\u2019s newly released best practices for securing Microsoft Intune; the principles of these recommendations can be applied to Intune and more broadly to other endpoint management software:
\nAdditionally, CISA recommends reviewing the following resources to strengthen defenses against similar malicious cyber activity:
\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.
\nMicrosoft and Stryker contributed to this alert.
\n1 For updates from Stryker on the incident, see \u201cCustomer Updates: Stryker Network Disruption,\u201d Stryker, last modified March 15, 2026, https://www.stryker.com/us/en/about/news/2026/a-message-to-our-customers-03-2026.html.
", "summary_is_html": true, "first_seen": "Wed, 18 Mar 26 12:00:00 +0000", "last_updated": "Wed, 18 Mar 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-adds-one-known-exploited-vulnerability-catalog-0", "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-adds-one-known-exploited-vulnerability-catalog-0", "summary": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Wed, 18 Mar 26 12:00:00 +0000", "last_updated": "Wed, 18 Mar 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-adds-one-known-exploited-vulnerability-catalog", "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-adds-one-known-exploited-vulnerability-catalog", "summary": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Wed, 18 Mar 26 12:00:00 +0000", "last_updated": "Wed, 18 Mar 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-04", "title": "Siemens SICAM SIAPP SDK", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-04", "summary": "\nThe SICAM SIAPP SDK contains multiple vulnerabilities that could allow an attacker to disrupt the customer-developed SIAPP or its simulation environment. Potential impacts include denial of service within the SIAPP, corruption of SIAPP data, or exploit the simulation environment. These vulnerabilities are only exploitable if the API is used improperly or hardening measures are not applied. Siemens has released a new version for SICAM SIAPP SDK and recommends to update to the latest version.
\nThe following versions of Siemens SICAM SIAPP SDK are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.4 | \nSiemens | \nSiemens SICAM SIAPP SDK | \nOut-of-bounds Write, Stack-based Buffer Overflow, Improper Handling of Length Parameter Inconsistency, External Control of File Name or Path | \n
An out-of-bounds write vulnerability exists in SICAM SIAPP SDK. This could allow an attacker to write data beyond the intended buffer, potentially leading to denial of service, or arbitrary code execution.
\n\nVendor fix
Update to V2.1.7 or later
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.4 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
The SICAM SIAPP SDK does not perform checks on input values potentially resulting in stack overflow. This could allow an attacker to perform code execution and denial of service.
\n\nVendor fix
Update to V2.1.7 or later
Relevant CWE: CWE-121 Stack-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.4 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
The SICAM SIAPP SDK client component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input that could trigger a stack overflow crashing the process and potentially causing denial of service.
\n\nVendor fix
Update to V2.1.7 or later
Relevant CWE: CWE-130 Improper Handling of Length Parameter Inconsistency
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.1 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
The SICAM SIAPP SDK server component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input that could trigger a stack overflow crashing the process and potentially causing denial of service.
\n\nVendor fix
Update to V2.1.7 or later
Relevant CWE: CWE-130 Improper Handling of Length Parameter Inconsistency
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.1 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
The affected application builds shell commands with caller-provided strings and executes them. An attacker could influence the executed command, potentially resulting in command injection and full system compromise.
\n\nVendor fix
Update to V2.1.7 or later
Relevant CWE: CWE-73 External Control of File Name or Path
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.4 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
The affected application performs file deletion without properly validating the file path or target. An attacker could delete files or sockets that the affected process has permission to remove, potentially resulting in denial of service or service disruption.
\n\nVendor fix
Update to V2.1.7 or later
Relevant CWE: CWE-73 External Control of File Name or Path
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.7 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H | \n
Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment. Recommended security guidelines can be found at: https://www.siemens.com/gridsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-903736 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-10 | \n1 | \nPublication Date | \n
| 2026-03-17 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-903736 advisory | \n
3. TECHNICAL DETAILS
\nThe following versions of CODESYS in Festo Automation Suite are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nFESTO, CODESYS | \nCODESYS in Festo Automation Suite | \nDirect Request ('Forced Browsing'), Untrusted Search Path, Improper Restriction of Operations within the Bounds of a Memory Buffer, Uncontrolled Recursion, Improper Access Control, Use of Insufficiently Random Values, Improper Restriction of Communication Channel to Intended Endpoints, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), NULL Pointer Dereference, Stack-based Buffer Overflow, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Incorrect Permission Assignment for Critical Resource, Improper Handling of Exceptional Conditions, Exposure of Resource to Wrong Sphere, Allocation of Resources Without Limits or Throttling, Use of a Broken or Risky Cryptographic Algorithm, Out-of-bounds Write, Weak Password Recovery Mechanism for Forgotten Password, Improper Privilege Management, Use of Password Hash With Insufficient Computational Effort, Buffer Access with Incorrect Length Value, Improper Input Validation, Improper Verification of Cryptographic Signature, Inadequate Encryption Strength, Origin Validation Error, Missing Release of Memory after Effective Lifetime, Improper Resource Shutdown or Release, Deserialization of Untrusted Data, Path Equivalence: '//multiple/leading/slash', Insufficient Verification of Data Authenticity, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Missing Authentication for Critical Function, Out-of-bounds Read, Failure to Sanitize Special Elements into a Different Plane (Special Element Injection), Use of Out-of-range Pointer Offset, Improper Neutralization of Script in Attributes of IMG Tags in a Web Page, Files or Directories Accessible to External Parties, Untrusted Pointer Dereference, Path Traversal: '....' (Multiple Dot), ASP.NET Misconfiguration: Missing Custom Error Page, Uncontrolled Resource Consumption, Unprotected Transport of Credentials, Initialization of a Resource with an Insecure Default, Heap-based Buffer Overflow, Unexpected Sign Extension, Buffer Over-read, Uncontrolled Search Path Element, Improper Verification of Source of a Communication Channel, Improper Restriction of Excessive Authentication Attempts, Use After Free, ASP.NET Misconfiguration: Password in Configuration File, Improper Check for Unusual or Exceptional Conditions, Observable Discrepancy, Incorrect Default Permissions | \n
An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-425 Direct Request ('Forced Browsing')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | \n
Untrusted search path vulnerability in the pthread_win32_process_attach_np function in pthreadGC2.dll in Pthreads-win32 2.8.0 allows local users to gain privileges via a Trojan horse quserex.dll file in the current working directory.NOTE: some of these details are obtained from third party information.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-426 Untrusted Search Path
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.0 | \n7.8 | \nHIGH | \nCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | \n
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-674 Uncontrolled Recursion
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | \n
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-284 Improper Access Control
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-330 Use of Insufficiently Random Values
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library content without checking its validity, which may allow the contents of manipulated libraries to be displayed or executed. The issue also exists for source libraries, but 3S-Smart Software Solutions GmbH strongly recommends distributing compiled libraries only.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.6 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | \n
3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA client that cause a NULL pointer dereference, which may trigger a denial-of-service condition.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-476 NULL Pointer Dereference
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-121 Stack-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-476 NULL Pointer Dereference
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this vulnerability. All variants of the CODESYS V3 products in all versions prior V3.5.16.10 containing the CmpRouter or CmpRouterEmbedded component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PLCnext, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS Control V3 Runtime System Toolkit, CODESYS V3 Embedded Target Visu Toolkit, CODESYS V3 Remote Target Visu Toolkit, CODESYS V3 Safety SIL2, CODESYS Edge Gateway V3, CODESYS Gateway V3, CODESYS HMI V3, CODESYS OPC Server V3, CODESYS PLCHandler SDK, CODESYS V3 Simulation Runtime (part of the CODESYS Development System).
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-732 Incorrect Permission Assignment for Critical Resource
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-755 Improper Handling of Exceptional Conditions
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-284 Improper Access Control
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-668 Exposure of Resource to Wrong Sphere
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | \n
An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker without knowledge of the current password.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-640 Weak Password Recovery Mechanism for Forgotten Password
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-269 Improper Privilege Management
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | \n
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-916 Use of Password Hash With Insufficient Computational Effort
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-805 Buffer Access with Incorrect Length Value
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverified length fields.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file signature checking mechanism, which allows attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file of an existing vendor. Only CmActLicense update files with CmActLicense Firm Code are affected.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-347 Improper Verification of Cryptographic Signature
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is running as server) and the server accepts external connections, which may allow an attacker to remotely communicate with the CodeMeter API.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-326 Inadequate Encryption Strength
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-346 Origin Validation Error
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data from the heap.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-404 Improper Resource Shutdown or Release
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-502 Deserialization of Untrusted Data
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-50 Path Equivalence: '//multiple/leading/slash'
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System 3.5.16. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-502 Deserialization of Untrusted Data
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-502 Deserialization of Untrusted Data
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-50 Path Equivalence: '//multiple/leading/slash'
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-50 Path Equivalence: '//multiple/leading/slash'
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-502 Deserialization of Untrusted Data
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-345 Insufficient Verification of Data Authenticity
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODESYS packages with malicious content.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-345 Insufficient Verification of Data Authenticity
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-476 NULL Pointer Dereference
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.3 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | \n
CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | \n
CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-755 Improper Handling of Exceptional Conditions
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-823 Use of Out-of-range Pointer Offset
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | \n
A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-82 Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-552 Files or Directories Accessible to External Parties
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affected CODESYS products and may result in a denial-of-service condition.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-476 NULL Pointer Dereference
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-476 NULL Pointer Dereference
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.0 | \n7.5 | \nHIGH | \nCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-755 Improper Handling of Exceptional Conditions
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | \n
All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to enumerate valid users.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | \n
Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | \n
An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-476 NULL Pointer Dereference
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.0 | \n6.5 | \nMEDIUM | \nCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor control the values to be written. If invalid memory is accessed, this results in a crash.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-822 Untrusted Pointer Dereference
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H | \n
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-668 Exposure of Resource to Wrong Sphere
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | \n
The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-732 Incorrect Permission Assignment for Critical Resource
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-33 Path Traversal: '....' (Multiple Dot)
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-12 ASP.NET Misconfiguration: Missing Custom Error Page
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-400 Uncontrolled Resource Consumption
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Existing connections are not affected.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-400 Uncontrolled Resource Consumption
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-523 Unprotected Transport of Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-1188 Initialization of a Resource with an Insecure Default
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-82 Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-122 Heap-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-194 Unexpected Sign Extension
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service condition. User Interaction is not required.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checking the size of the service, resulting in a denial-of-service condition. User Interaction is not required.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
Multiple CODESYS Products are prone to a buffer over read. A low privileged remote attacker may craft a request with an invalid offset, which can cause an internal buffer over-read, resulting in a denial-of-service condition. User interaction is not required.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-126 Buffer Over-read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-823 Use of Out-of-range Pointer Offset
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.0 | \n8.1 | \nHIGH | \nCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | \n
In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-552 Files or Directories Accessible to External Parties
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.0 | \n8.8 | \nHIGH | \nCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-326 Inadequate Encryption Strength
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.7 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | \n
In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-1188 Initialization of a Resource with an Insecure Default
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An authenticated remote attacker may use a stack basedout-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context .
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-427 Uncontrolled Search Path Element
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.3 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H | \n
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-940 Improper Verification of Source of a Communication Channel
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n3.3 | \nLOW | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | \n
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-668 Exposure of Resource to Wrong Sphere
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.3 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H | \n
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37546, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549, CVE-2023-37550
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37550
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37549.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-552 Files or Directories Accessible to External Parties
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | \n
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37553, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37555 and CVE-2023-37556.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37556.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37555.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37559
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37558
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vulnerability.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-416 Use After Free
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.5 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | \n
A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-13 ASP.NET Misconfiguration: Password in Configuration File
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.6 | \nMEDIUM | \nCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-default Basic128Rsa15 security policy.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-203 Observable Discrepancy
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-276 Incorrect Default Permissions
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.5 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | \n
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-732 Incorrect Permission Assignment for Critical Resource
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.3 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L | \n
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing option elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.9 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N | \n
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
\n\nMitigation
FESTO has identified the following specific workarounds and mitigations users can apply to reduce risk:
Mitigation
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Mitigation
The following product versions have been fixed:
Mitigation
CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138 are fixed versions for all CVEs
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json
Mitigation
For more information see the associated Festo SE & Co. KG security advisory FSA-202601 FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF, FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML.
https://certvde.com/en/advisories/VDE-2025-108
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-17 | \n1 | \nInitial Republication of Festo SE & Co. KG FSA-202601 | \n
Schneider Electric is aware of a vulnerability in its SCADAPack\u2122 x70 RTU products. The SCADAPack\u2122 47xi, SCADAPack\u2122 47x and SCADAPack\u2122 57x product are Remote Terminal Units that provide communication capabilities for remote monitoring and control. Failure to apply the remediations provided below may risk unauthorized access to your RTU, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller.
\nThe following versions of Schneider Electric SCADAPack and RemoteConnect are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nSchneider Electric | \nSchneider Electric SCADAPack and RemoteConnect | \nImproper Check for Unusual or Exceptional Conditions | \n
CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol.
\n\nVendor fix
Version R3.4.2 (Firmware version 9.12.2) of SCADAPack\u2122 47x and SCADAPack\u2122 47xi includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/RemoteConnect/
Vendor fix
Version R3.4.2 of RemoteConnect includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/RemoteConnect/
Mitigation
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Follow the information according to SCADAPack\u2122 Security Guidelines in section 8.3 Secured Communication. Also, apply the following standard practices to reduce the risk of exploit: \u2022 Setup network segmentation and implement the RTU firewall service to block all unauthorized access to services \u2022 Disable the logic debug service.
Mitigation
Follow the information according to SCADAPack\u2122 Security Guidelines in section 8.3 Secured Communication. Also, apply the following standard practices to reduce the risk of exploit \u2022 Setup network segmentation and implement the RTU firewall service to block all unauthorized access to services. \u2022 Disable the logic debug service.
Relevant CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
We strongly recommend the following industry cybersecurity best practices. * Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. * Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks. * Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode. * Never connect programming software to any network other than the network intended for that device. * Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks. * Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation. * Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.
\nThis document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
\nTHIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION
\nSchneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and sustainability for all. We call this Life Is On. Our mission is to be the trusted partner in Sustainability and Efficiency. We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation, software and services, delivering digital twins to enable profitable growth for our customers. We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our meaningful purpose of a sustainable future for all. www.se.com
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Schneider Electric CPCERT SEVD-2026-041-01 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric CPCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-02-10 | \n1 | \nOriginal Release | \n
| 2026-03-17 | \n2 | \nInitial CISA Republication of Schneider Electric CPCERT SEVD-2026-041-01 advisory | \n
Schneider Electric is aware of a hard-coded credentials vulnerability in its EcoStruxure IT Data Center Expert (DCE) product that requires administrator credentials and enabling a feature (SOCKS Proxy) that is off by default. The EcoStruxure IT Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehensive view of equipment. Failure to apply the remediation provided below may risk information disclosure, and remote compromise of the offer which could result in disruption of operations and access to system data.
\nThe following versions of Schneider Electric EcoStruxure Data Center Expert are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.2 | \nSchneider Electric | \nSchneider Electric EcoStruxure Data Center Expert | \nUse of Hard-coded Credentials | \n
A hard-coded credentials vulnerability exists that could lead to information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known. SOCKS Proxy is disabled by default.
\n\nVendor fix
v9.1 of EcoStruxure IT Data Center Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/en/product-range/61851-ecostruxure-it-data-center-expert/#software-and-firmware
Mitigation
If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: \u2022 Harden the DCE instance according to the cybersecurity best practices documented in the EcoStruxure IT Data Center Expert Security Handbook \u2022 Ensure the SOCKS Proxy is disabled as in the default configuration.
Mitigation
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-069-05 Use of Hard-coded Credentials vulnerability in EcoStruxure IT Data Center Expert PDF Version https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-05.pdf
Mitigation
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-069-05 Use of Hard-coded Credentials vulnerability in EcoStruxure IT Data Center Expert CSAF Version https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-069-05.json
Relevant CWE: CWE-798 Use of Hard-coded Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.2 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | \n
Schneider Electric strongly recommends the following industry cybersecurity best practices: * Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. * Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks. * Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode. * Never connect programming software to any network other than the network intended for that device. * Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks. * Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation. * Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.
\nThis document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric\u2019s products, visit the company\u2019s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
\nTHIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION
\nSchneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and sustainability for all. We call this Life Is On. Our mission is to be the trusted partner in Sustainability and Efficiency. We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation, software and services, delivering digital twins to enable profitable growth for our customers. We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our meaningful purpose of a sustainable future for all. www.se.com
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Schneider Electric CPCERT SEVD-2026-069-05 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric CPCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-10 | \n1 | \nOriginal Release | \n
| 2026-03-17 | \n2 | \nInitial CISA Republication of Schneider Electric SEVD-2026-069-05 advisory | \n
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Fri, 13 Mar 26 12:00:00 +0000", "last_updated": "Fri, 13 Mar 26 12:00:00 +0000" } ]