CVE-2022-32136 CODESYS CVE debrief

Who should care

Organizations running Festo Automation Suite deployments that include CODESYS components, especially OT/ICS teams, plant engineers, and patch-management staff responsible for industrial automation workstations and associated software maintenance.

Technical summary

The advisory describes a network-accessible flaw where a low-privileged remote attacker can send a crafted request that causes a read access to an uninitialized pointer, leading to a denial-of-service. The supplied CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, which aligns with availability impact only and no user interaction requirement. The affected configurations listed in the source include Festo Automation Suite versions below 2.8.0.138 and specific bundle combinations with CODESYS Development System 3.0, 3.5.16.10, and 3.5.21.20.

Defensive priority

Medium. The issue is remotely reachable, requires only low privileges, and can interrupt availability in industrial software, but the supplied source describes denial-of-service rather than code execution or data loss.

Recommended defensive actions

• Update Festo Automation Suite to version 2.8.0.138 or later, as identified in the advisory.
• Install the latest patched CODESYS release directly from the official CODESYS website.
• Follow the CODESYS installation and update instructions so security fixes are applied correctly.
• Keep monitoring CODESYS and Festo security advisories and apply updates promptly.
• Maintain the Festo Automation Suite connector at the latest released version from Festo.

Evidence notes

The primary evidence is CISA advisory ICSA-26-076-01, which republishes the Festo advisory FSA-202601 and states that a low-privileged remote attacker can trigger a read access to an uninitialized pointer, causing denial-of-service without user interaction. The source metadata lists affected Festo Automation Suite and CODESYS bundle combinations and provides the remediation to update to Festo Automation Suite 2.8.0.138 or later and install patched CODESYS versions. The CVE.org and NVD links are included as official record and database references in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.