CVE-2021-2389 Festo Didactic SE CVE debrief

Who should care

Operators and maintainers of Festo MES PC deployments, especially any environment that uses the affected Factory Control Panel or embedded MySQL components, plus teams responsible for network-exposed MySQL services in industrial or lab systems.

Technical summary

According to the supplied source text, the vulnerability affects Oracle MySQL Server InnoDB on supported versions 5.7.34 and earlier and 8.0.25 and earlier. The attack requires network access, does not require authentication, and is described as difficult to exploit. The impact is availability-only: a hang or repeatable crash of MySQL Server. The advisory references CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H with a score of 5.9. The CSAF remediation entry states that Festo released Factory Control Panel as a replacement for XAMPP on MES PCs and that the current version includes fixes.

Defensive priority

Medium. Treat as a service-availability risk that can disrupt MES PC operation or any dependent workflow. Prioritize remediation where the affected component is network reachable or part of production control tooling.

Recommended defensive actions

• Identify MES PC systems and any deployments that include the affected Factory Control Panel or embedded MySQL components described in the advisory.
• Apply the current Factory Control Panel version obtained through Festo support as directed in the remediation entry.
• Review whether the affected MySQL service is network exposed and restrict access to trusted hosts and required protocols only.
• Validate that patched systems no longer run the vulnerable versions referenced in the advisory and document the upgrade state.
• Monitor for hangs, repeated crashes, or service restarts affecting MySQL Server on MES PC systems.

Evidence notes

This debrief is based only on the supplied CSAF source item, its embedded remediation and reference metadata, and the official CVE/NVD links listed in the corpus. The advisory text explicitly states the impacted MySQL versions, the unauthenticated network attack precondition, and the availability impact. The source metadata also records the advisory publication date as 2024-02-27 and a CISA republication on 2026-01-27; the vendor remediation date shown in the corpus is 2023-05-26 and should be treated as remediation context, not the CVE issue date. The source references include a CWE-20 link, but the corpus excerpt does not provide a separate CWE mapping beyond that reference.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.