PatchSiren cyber security CVE debrief

CVE-2023-3662 CODESYS CVE debrief

CVE-2023-3662 is a local code-execution issue tied to CODESYS Development System components used with Festo Automation Suite. The advisory states that binaries from the current working directory can be executed in the user’s context, which can let an attacker influence what runs when a user launches the affected software from a writable location. The published CVSS 3.1 score is 7.3 (High), but the vector shows this is not a remote unauthenticated flaw; it requires local access, low privileges, and user interaction.

Vendor: CODESYS
Product: FESTO
CVSS: HIGH 7.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2023-07-11
Original CVE updated: 2026-01-20
Advisory published: 2023-07-11
Advisory updated: 2026-01-20

Who should care

OT/industrial automation teams, engineering workstation administrators, and Festo Automation Suite users who have CODESYS bundled or installed separately—especially environments running versions noted in the advisory.

Technical summary

The advisory describes a path-handling weakness consistent with CWE-427 (Uncontrolled Search Path Element): CODESYS Development System versions from 3.5.17.0 to prior to 3.5.19.20 may execute a binary from the current working directory in the context of the user running the program. The source advisory and CISA republication tie the issue to Festo Automation Suite deployments that bundled affected CODESYS components, and the provided CVSS vector is AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Defensive priority

High for affected engineering endpoints and OT support systems, because the impact is code execution in a user context and the vulnerable component appears in software used in industrial environments. Prioritize upgrades and replacement of bundled vulnerable CODESYS instances.

Recommended defensive actions

Upgrade to the latest patched CODESYS release directly from the official CODESYS website.
For Festo Automation Suite deployments, move to Festo Automation Suite 2.8.0.138 or later, where CODESYS is no longer bundled.
Apply Festo Automation Suite updates as they are released, including connector updates noted in the advisory.
Monitor Festo and CODESYS security advisories and verify that installed versions are not in the affected range (3.5.17.0 through 3.5.19.19).

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-076-01 (published 2026-02-26, republished 2026-03-17), which states: "In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context." The same advisory lists CVSS 3.1 7.3 with AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H and references the Festo CSAF and Festo PSIRT pages. The supplied vendor metadata is low-confidence and should be treated as needing review; the authoritative source associates the issue with Festo Automation Suite and CODESYS.

Sources and references

Verified primary and authoritative sources

CVE-2023-3662 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2023-3662

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2023-3662 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-3662

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json

Reference
Source reference
Unverified legacy reference

URL: https://certvde.com/en/advisories/vendor/festo/

Reference
Source reference
Unverified legacy reference

URL: https://www.festo.com/psirt

Reference
Source reference
Unverified legacy reference

URL: https://certvde.com/en/advisories/VDE-2025-108

Reference
Source reference
Unverified legacy reference

URL: https://www.cve.org/CVERecord?id=CVE-2025-2595

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.