PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-47381 CODESYS CVE debrief

CVE-2022-47381 is a high-severity flaw in CODESYS components used by Festo Automation Suite. The advisory says an authenticated remote attacker may trigger a stack-based out-of-bounds write, which can lead to denial of service, memory overwriting, or remote code execution. CISA published the advisory on 2026-02-26 and republished it with updated source material on 2026-03-17.

Vendor
CODESYS
Product
FESTO
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2023-07-11
Original CVE updated
2026-01-20
Advisory published
2023-07-11
Advisory updated
2026-01-20

Who should care

OT/ICS defenders, Festo Automation Suite administrators, and teams that deploy CODESYS Development System with the suite—especially environments using the affected version combinations listed in the advisory.

Technical summary

The source advisory identifies a stack-based out-of-bounds write in multiple CODESYS products and versions used in Festo Automation Suite. An authenticated remote attacker may write data into the stack, potentially causing denial of service, memory corruption, or remote code execution. The affected scope is version-combination specific and includes Festo Automation Suite versions below 2.8.0.138 as well as the listed bundled or external CODESYS Development System versions.

Defensive priority

High

Recommended defensive actions

  • Upgrade to the latest Festo Automation Suite release path noted in the advisory; starting with 2.8.0.138, CODESYS is no longer bundled with the suite.
  • Install the latest patched CODESYS version directly from the official CODESYS website.
  • Follow the vendor-provided installation and update instructions to ensure security fixes are applied correctly.
  • Keep the Festo Automation Suite connector up to date by applying Festo-released updates as they become available.
  • Monitor Festo and CODESYS security advisories regularly and prioritize patching affected OT/engineering workstations.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-076-01, republished from Festo PSIRT materials, with publishedAt 2026-02-26T08:00:00Z and modifiedAt 2026-03-17T06:00:00Z. The advisory title is "CODESYS in Festo Automation Suite" and its product list includes Festo Automation Suite plus specific CODESYS Development System versions and combinations. The source description explicitly states the authenticated remote stack-based out-of-bounds write impact. The vendor mapping in the prompt is low-confidence and should be treated as review-needed because the source centers on Festo Automation Suite/CODESYS rather than a standalone vendor attribution.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-47381 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-47381

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-47381 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-47381

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/vendor/festo/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.festo.com/psirt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/VDE-2025-108

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cve.org/CVERecord?id=CVE-2025-2595

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.