CVE-2022-47391 CODESYS CVE debrief

Who should care

OT/ICS administrators, engineers, and support teams using Festo Automation Suite and CODESYS Development System installations should review this advisory. It is especially relevant for organizations that rely on affected suite versions or CODESYS components in operational workflows, where a remote denial of service could interrupt engineering or control-related activities.

Technical summary

The advisory describes an improper input validation flaw in multiple CODESYS products and versions. The issue is reachable remotely without authorization and can cause reads from invalid memory addresses, which in turn leads to denial of service. The CISA CSAF record ties the issue to Festo Automation Suite deployments that include affected CODESYS components, including versions prior to 2.8.0.138 and specific bundled CODESYS Development System releases. Festo notes that starting with Festo Automation Suite 2.8.0.138, CODESYS is no longer bundled and must be downloaded and installed separately.

Defensive priority

High for affected environments that expose or rely on the vulnerable CODESYS components. Because the impact is availability-only but remotely reachable and unauthenticated, patching and version verification should be prioritized for any production or engineering system using the affected software stack.

Recommended defensive actions

• Verify whether Festo Automation Suite installations include affected CODESYS components and map them to the versions listed in the advisory.
• Update to Festo Automation Suite 2.8.0.138 or later where applicable, and confirm which CODESYS component version is installed separately.
• Install the latest patched CODESYS release directly from the official CODESYS website, following vendor installation and update instructions.
• Keep the Festo Automation Suite connector updated by applying Festo releases as they are issued.
• Monitor CODESYS and Festo security advisories for follow-up fixes and configuration guidance.
• Validate that affected engineering workstations and related systems are not running outdated bundled or manually installed CODESYS components.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-076-01 republished from Festo/CERT-VDE, which states that an unauthorized remote attacker may use improper input validation to read from invalid addresses and cause denial of service. The advisory also lists affected Festo Automation Suite and CODESYS versions, and provides mitigation guidance to update Festo Automation Suite and install patched CODESYS releases from the official source.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.