CVE-2019-9008 Festo CVE debrief

Who should care

OT/ICS operators, industrial automation engineers, and system administrators running CODESYS-based runtime environments—especially Festo Automation Suite installations that bundled CODESYS before version 2.8.0.138.

Technical summary

The advisory describes a low-privilege attack path to full runtime control in CODESYS V3 through 3.5.12.30. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High), indicating network-reachable impact with no user interaction required and potential for high confidentiality, integrity, and availability effects.

Defensive priority

High. In OT environments, a low-privilege path to runtime control can affect production logic and safety-adjacent operations. Systems running affected CODESYS versions or Festo Automation Suite deployments that include them should be prioritized for verification and update.

Recommended defensive actions

• Inventory Festo Automation Suite and CODESYS installations and confirm whether any affected versions are present.
• Upgrade Festo Automation Suite to version 2.8.0.138 or later, where CODESYS is no longer bundled.
• Download the latest patched CODESYS release directly from the official CODESYS website and follow vendor installation/update instructions.
• Review and apply Festo connector and suite updates as they are released.
• Monitor CODESYS security advisories and establish a prompt patching process for OT systems.
• Recheck least-privilege access controls and segment OT assets to reduce the blast radius of a compromised runtime.

Evidence notes

Source corpus ties this CVE to CISA’s CSAF advisory ICSA-26-076-01 and the republished Festo advisory FSA-202601. The advisory text states: 'An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.' Remediation notes state that starting with Festo Automation Suite 2.8.0.138, CODESYS is no longer bundled and must be downloaded and installed separately. The supplied timeline shows initial publication on 2026-02-26 and modification/republication on 2026-03-17.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.