CVE-2022-32081 Festo Didactic SE CVE debrief

Who should care

Operators and maintainers of Festo Didactic SE MES PC deployments, especially environments that include bundled MariaDB/XAMPP components or exposed management interfaces. Security teams responsible for industrial/OT-adjacent systems should prioritize review if the product is present, because the advisory assigns a network-reachable, no-authentication, high-availability-impact profile.

Technical summary

The source corpus describes CVE-2022-32081 as an out-of-bounds memory safety issue in MariaDB’s prepare_inplace_add_virtual path, characterized as use-after-poison. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attackability with low complexity and no privileges or user interaction required, and availability impact as the primary consequence. In the CISA CSAF record, the CVE is associated with Festo Didactic SE MES PC, and the remediation notes say Factory Control Panel replaces XAMPP on MES PCs, with a current version available through Festo technical support.

Defensive priority

High. The vulnerability is rated CVSS 7.5 (HIGH) with network access, no privileges, and no user interaction in the supplied vector. Even though confidentiality and integrity impacts are not indicated, the availability impact is high, which can be operationally significant for MES environments.

Recommended defensive actions

• Confirm whether your Festo Didactic SE MES PC deployment includes the affected software stack referenced in the advisory, including any MariaDB/XAMPP components.
• Obtain and deploy the current Factory Control Panel version from Festo technical support as stated in the remediation guidance.
• Treat exposed management or service interfaces as high priority until remediation is complete; apply compensating access controls where feasible.
• After updating, verify service health and confirm the vulnerable component has been replaced or upgraded successfully.
• Track the CISA CSAF advisory and vendor references for any follow-on revisions or product applicability updates.

Evidence notes

The supplied source data ties CVE-2022-32081 to a CISA CSAF advisory for Festo Didactic SE MES PC (ICSA-26-027-02) and states that MariaDB v10.4 to v10.7 contains a use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc. The remediation entry says Festo Didactic has released Factory Control Panel as a replacement for XAMPP on MES PCs and directs customers to technical support for the current version. The CVSS vector supplied in the record is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.