CVE-2023-37559 CODESYS CVE debrief

Who should care

OT/ICS administrators, Festo Automation Suite operators, and teams managing affected CODESYS Development System integrations, especially where authenticated users can reach the service over the network.

Technical summary

According to the CISA CSAF record, the issue occurs after successful user authentication in multiple CODESYS products and versions when specific crafted network requests with inconsistent content trigger an invalid internal read in CmpAppForce. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable issue with low attack complexity, low privileges required, no user interaction, and high availability impact. The advisory says this vulnerability is different from CVE-2023-37558.

Defensive priority

Medium. Prioritize it sooner if the affected suite supports production or safety-relevant operations, because even authenticated misuse can interrupt availability in OT environments.

Recommended defensive actions

• Upgrade to Festo Automation Suite 2.8.0.138 or later and follow Festo's guidance for separating the CODESYS installation from the suite.
• Install the latest patched CODESYS release directly from the official CODESYS website, using the vendor's update instructions.
• Keep the Festo Automation Suite connector up to date by applying Festo-released updates.
• Limit access to affected services to trusted, authenticated users and place OT systems behind appropriate network segmentation.
• Monitor Festo, CERT-VDE, CODESYS, and CISA advisories for follow-on fixes or compatibility notes.
• Validate the deployed versions/components in your environment before and after remediation, and test changes in a staging OT environment where possible.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-076-01 republishing the Festo advisory FSA-202601, which names Festo Automation Suite and CODESYS product/version combinations and describes the authenticated network-request condition leading to an invalid read in CmpAppForce. The supplied prompt metadata has low-confidence vendor attribution, so the summary follows the advisory's named product family rather than the placeholder vendor field. The source also provides the CVSS vector and states the issue is different from CVE-2023-37558.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.