PatchSiren cyber security CVE debrief

CVE-2019-13532 Festo CVE debrief

CVE-2019-13532 affects the CODESYS V3 web server prior to version 3.5.14.10. In the supplied CISA advisory ICSA-26-076-01, specially crafted HTTP or HTTPS requests may allow access to files outside the controller's restricted working directory. The advisory was published on 2026-02-26 and republished on 2026-03-17. For Festo Automation Suite users, the remediation notes say CODESYS is no longer bundled starting with Festo Automation Suite 2.8.0.138 and should be obtained as a separately patched release from the official CODESYS website.

Vendor: Festo
Product: Unknown
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-09-30
Original CVE updated: 2025-11-13
Advisory published: 2025-09-30
Advisory updated: 2025-11-13

Who should care

OT and ICS administrators, control engineers, and asset owners running CODESYS V3 web servers, especially those deployed through or alongside Festo Automation Suite.

Technical summary

The advisory describes a network-reachable web server issue in CODESYS V3 versions before 3.5.14.10. An attacker who can send crafted HTTP or HTTPS requests may be able to access files outside the controller's restricted working directory. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which aligns with a high-severity confidentiality impact and no required privileges or user interaction.

Defensive priority

High. Prioritize any reachable CODESYS web server in an OT environment, with the highest urgency for systems exposed beyond tightly controlled administration networks.

Recommended defensive actions

Upgrade CODESYS V3 web server installations to version 3.5.14.10 or later.
If using Festo Automation Suite, move to version 2.8.0.138 or later and confirm the CODESYS component is handled per the advisory guidance.
Download patched CODESYS releases only from the official CODESYS website and follow the vendor's update instructions.
Restrict access to controller web interfaces to trusted administration networks and keep CODESYS and Festo advisories under active monitoring.
Keep the Festo Automation Suite connector current by applying FAS updates as they are released by Festo.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-076-01, which was initially published on 2026-02-26 and republished on 2026-03-17. The source text states that CODESYS V3 web server versions prior to 3.5.14.10 may allow specially crafted HTTP or HTTPS requests to access files outside the controller's restricted working directory. The remediation section states that Festo Automation Suite 2.8.0.138 no longer bundles CODESYS and directs customers to install the latest patched CODESYS release from the official CODESYS website.

Sources and references

Verified primary and authoritative sources

CVE-2019-13532 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2019-13532

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2019-13532 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-13532

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-273-04.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-04

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.