CVE-2022-47380 CODESYS CVE debrief

Who should care

OT/ICS administrators, automation engineers, Festo Automation Suite users, CODESYS integrators, and vulnerability/patch management teams responsible for engineering workstations or systems that use the affected software components.

Technical summary

The advisory describes an authenticated remote stack-based out-of-bounds write in multiple CODESYS products and versions associated with Festo Automation Suite. The flaw can write data into the stack, creating a path to denial of service, memory corruption, and potentially remote code execution. Festo’s mitigation guidance says that starting with Festo Automation Suite 2.8.0.138, CODESYS is no longer bundled and must be downloaded and installed separately; customers should install the latest patched CODESYS release from the official CODESYS website, follow vendor update instructions, and keep the Festo Automation Suite connector current.

Defensive priority

High priority for any environment using Festo Automation Suite or bundled/separately installed CODESYS components, especially where engineering systems are operationally critical or patching is delayed.

Recommended defensive actions

• Identify all installations of Festo Automation Suite and any associated CODESYS components.
• Determine whether affected versions are present, including Festo Automation Suite versions earlier than 2.8.0.138 and the CODESYS versions named in the advisory.
• Apply the vendor-recommended updates for Festo Automation Suite and install the latest patched CODESYS release from the official CODESYS source.
• Follow the installation and update procedures provided by CODESYS to ensure security fixes are fully applied.
• Keep the Festo Automation Suite connector updated with the latest Festo releases.
• Review local access controls for systems running these components, since exploitation requires authentication.
• Monitor vendor and CISA advisories for follow-up revisions or related guidance.

Evidence notes

CISA’s CSAF advisory ICSA-26-076-01, published on 2026-02-26 and republished on 2026-03-17 from Festo’s advisory FSA-202601, states that an authenticated remote attacker may use a stack-based out-of-bounds write in multiple CODESYS products/versions to cause denial of service, memory overwriting, or remote code execution. The advisory’s remediation section says Festo Automation Suite 2.8.0.138 and later no longer bundle CODESYS, and directs customers to install patched CODESYS releases from official vendor sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.