PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-6357 CODESYS CVE debrief

CVE-2023-6357 is a high-severity command-injection issue in the Festo Automation Suite / CODESYS software path. According to the advisory, a low-privileged remote attacker could inject additional system commands via file system libraries and potentially gain full control of the device. The published remediation path is to move to Festo Automation Suite 2.8.0.138 or later and use patched CODESYS releases from the official vendor.

Vendor
CODESYS
Product
FESTO
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-26
Original CVE updated
2026-03-17
Advisory published
2026-02-26
Advisory updated
2026-03-17

Who should care

OT/ICS defenders, Festo Automation Suite administrators, and teams managing engineering workstations or automation environments that bundle CODESYS components should prioritize this issue.

Technical summary

CISA's CSAF advisory ICSA-26-076-01 was published on 2026-02-26 and republished on 2026-03-17 as an initial CISA republication of the Festo advisory. The source describes a low-privileged remote command-injection path in file system libraries, with CVSS 3.1 scored at 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected scope in the supplied advisory includes Festo Automation Suite versions below 2.8.0.138 with bundled CODESYS components, and the remediation is to update Festo Automation Suite, then install patched CODESYS directly from the official site.

Defensive priority

High

Recommended defensive actions

  • Upgrade Festo Automation Suite to version 2.8.0.138 or later on all affected systems.
  • Install the latest patched CODESYS release directly from the official CODESYS website and verify the component version in each environment.
  • Update the Festo Automation Suite connector with vendor-provided releases and confirm no bundled vulnerable CODESYS component remains in use.
  • Restrict remote access to engineering and OT environments, and apply least privilege plus defense-in-depth controls around automation workstations.
  • Monitor Festo PSIRT, CertVDE, and CISA ICS advisories for follow-on updates or newly identified affected versions.
  • Inventory all systems running Festo Automation Suite with CODESYS components to ensure no unmanaged deployments remain exposed.

Evidence notes

The debrief is based on the supplied CISA CSAF source item for ICSA-26-076-01, which names the issue 'CODESYS in Festo Automation Suite' and provides the affected product strings, CVSS vector, and remediation text. The timeline uses the supplied publishedAt and modifiedAt values (2026-02-26 and 2026-03-17) from the advisory metadata. Vendor attribution in the prompt is low-confidence, so the analysis stays anchored to the advisory/product naming present in the source corpus rather than broadening scope beyond it.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-6357 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-6357

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-6357 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-6357

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/vendor/festo/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.festo.com/psirt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/VDE-2025-108

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cve.org/CVERecord?id=CVE-2025-2595

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.