CVE-2022-27447 Festo Didactic SE CVE debrief

Who should care

Festo Didactic SE MES PC operators, OT/ICS administrators, and teams responsible for the underlying MariaDB/XAMPP-based software stack should review this advisory and confirm whether affected components are still deployed.

Technical summary

The advisory describes a use-after-free in Binary_string::free_buffer() at /sql/sql_string.h. The supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which indicates a network-reachable issue with low attack complexity, no privileges or user interaction required, and high availability impact. The source material does not describe confidentiality or integrity impact.

Defensive priority

High: prioritize systems that still run the affected MES PC software stack or any MariaDB Server v10.9 and below instance identified in the advisory chain, especially where the service is exposed or operational uptime matters.

Recommended defensive actions

• Inventory Festo Didactic SE MES PC deployments and confirm whether the current Factory Control Panel release is installed.
• Obtain the current Factory Control Panel from Festo technical support as directed in the advisory ([email protected]) and plan deployment in a maintenance window.
• Identify any MariaDB Server v10.9 and below instances on affected systems and apply the vendor-provided fix path or replacement software as applicable.
• Plan for a restart of the vulnerable component during remediation, as the advisory marks restart as required for the vulnerable component.
• Apply CISA ICS recommended practices such as segmentation, defense in depth, and least-privilege access around the affected systems.

Evidence notes

Source material ties CVE-2022-27447 to Festo Didactic SE MES PC and states: 'MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h.' The CVSS vector in the supplied advisory is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, supporting an availability-focused assessment. The remediation entry explicitly references Festo’s current Factory Control Panel and support contact. Timeline context: CVE published 2024-02-27 and CISA republication/modified record date is 2026-01-27; no CISA KEV entry is provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.