PatchSiren

PatchSiren cyber security CVE debrief

CVE-2010-5250 Festo CVE debrief

CVE-2010-5250 describes a local privilege-escalation risk caused by an untrusted search path in pthread_win32_process_attach_np inside pthreadGC2.dll. In the supplied CISA CSAF context, the issue is republished for Festo Automation Suite/CODESYS deployments and mitigated by moving to Festo Automation Suite 2.8.0.138 or later and applying the latest CODESYS fixes.

Vendor
Festo
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-09-30
Original CVE updated
2025-11-13
Advisory published
2025-09-30
Advisory updated
2025-11-13

Who should care

OT/ICS administrators, Windows engineering-workstation owners, and any team running Festo Automation Suite with bundled CODESYS components should review this advisory. It matters most where untrusted local users can influence the working directory or where privileged processes start from writable paths.

Technical summary

The CVE text says Pthreads-win32 2.8.0 has an untrusted search path issue in pthread_win32_process_attach_np within pthreadGC2.dll. If a malicious quserex.dll is placed in the current working directory, the process may load that Trojan horse DLL and a local attacker can gain elevated privileges. The CISA-republished advisory maps the impacted packaging to Festo Automation Suite versions below 2.8.0.138 and specific bundled CODESYS Development System combinations.

Defensive priority

High

Recommended defensive actions

  • Upgrade Festo Automation Suite to version 2.8.0.138 or later, where CODESYS is no longer bundled with the suite.
  • Install the latest patched CODESYS release directly from the official CODESYS website and follow the vendor’s update instructions.
  • Audit engineering workstations and service accounts so privileged processes do not run from user-writable directories.
  • Monitor CISA, Festo, and CERTVDE advisories for follow-up updates and apply patches promptly.

Evidence notes

This debrief relies on the supplied CISA CSAF source item and its linked official references. The source description explicitly notes that some details come from third-party information, so vendor/product attribution should be treated carefully. The advisory metadata ties the issue to Festo Automation Suite/CODESYS packaging, while the CVE description itself names Pthreads-win32 2.8.0 and pthreadGC2.dll; that context mismatch is preserved rather than resolved here.

Sources and references

Verified primary and authoritative sources

  • CVE-2010-5250 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2010-5250

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2010-5250 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2010-5250

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-273-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.