PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-9010 Festo CVE debrief

CVE-2019-9010 is a critical authentication/authorization flaw in the CODESYS Gateway used by multiple CODESYS V3 products. According to the CISA CSAF advisory published on 2026-02-26 and updated on 2026-03-17, the gateway does not correctly verify ownership of a communication channel. The advisory says all variants of the listed CODESYS V3 products that include the CmpGateway component are affected in versions prior to v3.5.14.20, regardless of CPU type or operating system. For Festo Automation Suite users, the remediation guidance says to install the latest patched CODESYS release from the official CODESYS site and keep Festo Automation Suite connector updates current.

Vendor
Festo
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-09-30
Original CVE updated
2025-11-13
Advisory published
2025-09-30
Advisory updated
2025-11-13

Who should care

OT/ICS operators, automation engineers, and administrators running CODESYS V3 components, especially CODESYS Gateway V3, CODESYS Development System, or Festo Automation Suite installations that rely on CODESYS.

Technical summary

The issue is an ownership-verification failure in the CODESYS Gateway communication channel handling. Because channel ownership is not correctly validated, an unauthorized party may be able to interact with gateway-managed communications. The advisory marks the issue as network-reachable with no privileges required and high confidentiality, integrity, and availability impact (CVSS 3.1: 9.8). Affected products include CODESYS Control for BeagleBone, emPC-A/iMX6, IOT2000, Linux, PFC100, PFC200, Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, and CODESYS V3 Development System, for versions prior to v3.5.14.20 when they contain CmpGateway.

Defensive priority

Immediate

Recommended defensive actions

  • Inventory all systems using CODESYS V3 components, especially any installation that includes CmpGateway or CODESYS Gateway V3.
  • Upgrade affected CODESYS products to v3.5.14.20 or later, following vendor instructions.
  • If using Festo Automation Suite, update to the latest supported release and follow Festo’s guidance for separately installing CODESYS updates when required.
  • Apply the latest patched CODESYS release from the official CODESYS website rather than relying on bundled copies.
  • Keep Festo Automation Suite connector updates current and monitor CODESYS and CISA advisories for follow-on guidance.
  • Reduce exposure of OT gateway services through network segmentation and restrict access to trusted administrative paths.

Evidence notes

Primary evidence comes from the CISA CSAF advisory source item and its mirrored vendor references. The source text explicitly states the channel-ownership verification flaw, the affected CODESYS V3 product list, and the version boundary of v3.5.14.20. The remediation text in the advisory states that from Festo Automation Suite 2.8.0.138 onward, CODESYS is no longer bundled and must be downloaded and installed separately by the customer. The input metadata shows low-confidence vendor attribution, so the product/vendor mapping should be treated carefully and reviewed against the advisory title and affected-product list.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-9010 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-9010

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-9010 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-9010

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-273-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.