CVE-2022-27377 Festo Didactic SE CVE debrief

Who should care

Festo Didactic SE MES PC operators, OT/industrial control administrators, and security teams responsible for systems that rely on the affected MariaDB/XAMPP-related software stack should prioritize this issue.

Technical summary

The supplied advisory describes a use-after-free vulnerability (CWE-416) in MariaDB Server’s Item_func_in::cleanup() component path. The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which indicates network exposure, no privileges required, no user interaction, and a high availability impact. The source corpus ties the issue to the Festo Didactic MES PC advisory and remediation path, not to a KEV listing or confirmed ransomware use.

Defensive priority

High. The scoring is 7.5 HIGH and the attack surface is described as network-reachable with no privileges or user interaction required. Systems running the affected MES PC software stack should be reviewed and updated promptly.

Recommended defensive actions

• Obtain and deploy the current Festo Factory Control Panel version from the vendor channel referenced in the advisory.
• Inventory MES PCs and confirm whether the affected XAMPP/MariaDB-related software stack is present.
• Restrict access to database and management interfaces to trusted OT/admin networks only.
• Monitor affected systems for abnormal crashes, restarts, or database instability consistent with a memory-safety issue.
• Validate backups and recovery procedures before making software changes on production MES PCs.
• Follow the linked CISA and vendor advisory pages for any later updates or replacement guidance.

Evidence notes

The source corpus explicitly states: “MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.” The remediation entry says Festo Didactic released Factory Control Panel as a replacement for XAMPP on its MES PCs and instructs customers to contact technical support for the current version. The supplied timeline shows the CVE/public advisory date as 2024-02-27 and a later republication/modification on 2026-01-27; the later date should not be treated as the original issue date. No KEV entry is provided in the corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.