CVE-2021-2011 Festo Didactic SE CVE debrief

Who should care

Operators and maintainers of Festo Didactic SE MES PC deployments, especially where the affected Oracle MySQL Client C API component is present and network-accessible. Asset owners should also care if they rely on bundled or embedded client software that may still be on MySQL Client 5.7.32/8.0.22 or earlier.

Technical summary

The source description states that CVE-2021-2011 affects the MySQL Client product of Oracle MySQL, specifically the C API component, with affected versions 5.7.32 and prior and 8.0.22 and prior. The issue is reachable over the network via multiple protocols and can be triggered by an unauthenticated attacker to produce a hang or a frequently repeatable crash, resulting in complete denial of service. The CVSS vector supplied is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Defensive priority

Medium priority. The impact is availability-only but can be disruptive for exposed MES PC installations or any system using the affected client library. Prioritize if the component is network-reachable or if a crash would interrupt industrial or operational workflows.

Recommended defensive actions

• Identify whether MES PC systems include the affected Oracle MySQL Client C API versions (5.7.32 and earlier, or 8.0.22 and earlier).
• Apply the vendor-provided replacement guidance: Festo Didactic states that Factory Control Panel replaces XAMPP on MES PCs and includes fixes for the reported vulnerabilities.
• Obtain the current version through Festo technical support at [email protected], as directed in the advisory.
• Plan for a restart or maintenance window if the vulnerable component must be restarted during remediation.
• Validate post-update stability on representative MES PC systems and watch for hangs or repeated crashes during normal client activity.
• If immediate remediation is not possible, reduce exposure by limiting network access to the affected client systems and the protocols they use.

Evidence notes

This debrief is based on the supplied CISA CSAF source item ICSA-26-027-02 and its referenced Festo advisory materials. The source description ties CVE-2021-2011 to Oracle MySQL Client C API and lists Festo Didactic SE MES PC as the product context. The advisory’s remediation section says Festo Didactic released Factory Control Panel as a replacement for XAMPP on MES PCs and that the current version contains fixes. No KEV listing or ransomware-use field was provided in the corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.