CVE-2021-46667 Festo Didactic SE CVE debrief

Who should care

Operators of Festo Didactic SE MES PC deployments, administrators running affected MariaDB versions before 10.6.5, and teams responsible for production systems where a local crash would interrupt operations.

Technical summary

The source advisory links CVE-2021-46667 to an integer overflow in MariaDB's sql_lex.cc, with impact limited to an application crash. The supplied CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a locally reachable issue requiring low privileges and resulting in high availability impact. The CISA CSAF metadata maps the advisory to Festo Didactic SE MES PC and notes a replacement product path via Factory Control Panel.

Defensive priority

Medium priority: address during normal maintenance, but move faster if the vulnerable component is present on production MES PCs or any local user can interact with it.

Recommended defensive actions

• Confirm whether any deployed systems include MariaDB versions earlier than 10.6.5 or the Festo Didactic SE MES PC configuration named in the advisory.
• Apply the vendor-provided replacement: obtain the current Factory Control Panel from Festo technical support, as stated in the CSAF remediation.
• If you manage MariaDB directly in another context, upgrade to MariaDB 10.6.5 or later where applicable.
• Limit local access and privileges on affected hosts to reduce exposure to the locally exploitable crash condition.
• Monitor affected systems for unexpected MariaDB or application crashes and verify recovery procedures for production MES environments.

Evidence notes

The source corpus is a CISA CSAF advisory for "Festo Didactic SE MES PC" (ICSA-26-027-02) published on 2024-02-27, with later revision history including a 2026-01-27 republication entry. The advisory description explicitly states: "MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash." The remediation section states that Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs and directs users to obtain the current version from Festo support. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The 2026-01-27 timestamp in the corpus is a republication/revision date, not the original vulnerability date.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.