CVE-2022-27457 Festo Didactic SE CVE debrief

Who should care

Festo Didactic MES PC operators, OT/ICS administrators, and support teams responsible for systems that still rely on the affected MariaDB/XAMPP-based stack.

Technical summary

The supplied record describes a CWE-416 use-after-free in MariaDB Server v10.6.3 and below, at my_mb_wc_latin1 in /strings/ctype-latin1.c. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network-reachable condition with high availability impact and no listed confidentiality or integrity impact. The corpus does not provide exploitation details beyond this classification.

Defensive priority

High. The score is 7.5 and the CVSS vector indicates no privileges or user interaction, so affected deployments should be prioritized for remediation. There is no KEV listing or threat-campaign attribution in the supplied source corpus, so this is urgent from a patch-management perspective rather than an emergency exploit-response event.

Recommended defensive actions

• Confirm whether any MES PC deployments still use the affected MariaDB/XAMPP-based configuration.
• Obtain and deploy the current Festo Factory Control Panel version from Festo technical support, as the advisory says it replaces XAMPP and includes fixes.
• Plan maintenance for the vulnerable component, including any required restart or service reload.
• Limit exposure of affected OT/ICS systems and follow CISA ICS recommended practices for segmentation and defense in depth.
• Validate the remediation on a test system and verify the updated version is actually in place before returning the system to service.

Evidence notes

This debrief is constrained to the supplied CISA CSAF advisory and the linked official references. The advisory text ties the vulnerability description to MariaDB Server v10.6.3 and below, while the product context is Festo Didactic SE MES PC; that scope should be read from the advisory rather than inferred beyond the corpus. The source item shows initial publication on 2024-02-27 and a later CISA republication on 2026-01-27. No KEV entry, ransomware association, or exploit code is present in the supplied material.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.