CVE-2021-33485 Festo CVE debrief

Who should care

OT/ICS operators using Festo Automation Suite, engineers managing CODESYS-based automation deployments, and security teams responsible for industrial endpoints or engineering workstations that run bundled CODESYS components.

Technical summary

The core flaw is a heap-based buffer overflow in CODESYS Control Runtime versions before 3.5.17.10. The CISA advisory lists Festo Automation Suite/CODESYS combinations among the affected product context, including Festo Automation Suite releases below 2.8.0.138 with specific bundled CODESYS Development System versions. The source corpus also notes that, starting with Festo Automation Suite 2.8.0.138, CODESYS is no longer bundled with the suite and must be installed separately. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8).

Defensive priority

Immediate

Recommended defensive actions

• Upgrade CODESYS Control Runtime to version 3.5.17.10 or later, using the latest patched CODESYS release from the official CODESYS website.
• Update Festo Automation Suite to the latest supported release and verify whether CODESYS is bundled or installed separately in your deployment.
• Inventory Festo Automation Suite installations and identify systems using affected CODESYS builds referenced in the advisory corpus, especially combinations below 2.8.0.138.
• Apply vendor-recommended installation and update instructions, then validate that the patched runtime is present after maintenance.
• Monitor CODESYS and Festo security advisories and apply future updates promptly.
• Use industrial control system defense-in-depth practices, including network segmentation and exposure minimization, to reduce the blast radius of vulnerable engineering or runtime systems.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory ICSA-26-076-01 (source item URL: raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json), published 2026-02-26 and republished 2026-03-17. The advisory metadata identifies the issue as CVE-2021-33485 and states: 'CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.' The corpus references the CISA advisory page, the vendor PSIRT page, the CertVDE vendor page, the vendor advisory FSA-202601, the CVE record, the CWE-787 reference, and the CVSS calculator. Vendor attribution in the user-supplied corpus is inconsistent, so product naming should be treated as advisory-context dependent rather than a single definitive vendor product label.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.