CVE-2022-47389 CODESYS CVE debrief

Who should care

Administrators and defenders responsible for Festo Automation Suite installations, especially environments that bundle or depend on affected CODESYS components, should review exposure and patch status.

Technical summary

The advisory identifies a stack-based out-of-bounds write in the CmpTraceMgr component of multiple CODESYS products. CISA's affected-product list includes Festo Automation Suite <2.8.0.138 with CODESYS Development System 3.0 or 3.5.16.10, Festo Automation Suite 2.8.0.137 with those same CODESYS versions, and CODESYS Development System 3.5.21.20 as an external component of Festo Automation Suite 2.8.0.138. The stated impact is denial of service, memory corruption, and possible remote code execution from an authenticated remote attacker.

Defensive priority

High. The combination of network attack surface, low attack complexity, required authentication, and potential RCE makes this a priority patching issue for affected deployments.

Recommended defensive actions

• Identify whether Festo Automation Suite is installed and verify the exact bundled or external CODESYS component version.
• Upgrade to Festo Automation Suite 2.8.0.138 or later and follow Festo's and CODESYS's current installation/update guidance.
• Download patched CODESYS releases only from the official CODESYS website, as recommended in the advisory.
• Apply Festo Automation Suite connector updates when released and keep both the suite and dependent components current.
• Review access controls for authenticated remote access paths to affected systems and limit them to necessary administrators.
• Monitor CISA, CERT@VDE, Festo PSIRT, and CODESYS security advisories for follow-up guidance.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-076-01 and its source references. The advisory text explicitly names the CmpTraceMgr stack-based out-of-bounds write, the impacted Festo Automation Suite/CODESYS version combinations, and the vendor-recommended mitigations. The supplied materials do not include exploit code or public weaponization details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.