CVE-2021-36764 Festo CVE debrief

Who should care

OT/ICS administrators, Festo Automation Suite operators, and teams responsible for CODESYS Gateway V3 or bundled CODESYS Development System installations. This is most important where service availability matters and where systems may still be running the affected pre-3.5.17.10 CODESYS Gateway V3 component or older Festo Automation Suite bundles.

Technical summary

The advisory describes a NULL pointer dereference in CODESYS Gateway V3 before 3.5.17.10. A crafted communication request can crash the affected component and cause denial of service. The source metadata ties the issue to Festo Automation Suite deployments that include CODESYS components, including older bundle combinations listed in the advisory. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so the primary impact is availability.

Defensive priority

High. Prioritize patching and version verification in any environment exposing the affected CODESYS gateway or dependent Festo Automation Suite installations, especially if downtime would affect production or safety-related operations.

Recommended defensive actions

• Update CODESYS Gateway V3 to 3.5.17.10 or later.
• Update Festo Automation Suite to 2.8.0.138 or later and verify which CODESYS components are installed separately.
• Inventory systems for the affected Festo Automation Suite and CODESYS version combinations named in the advisory.
• Limit network exposure to CODESYS gateway services and apply CISA ICS recommended practices for segmentation and defense in depth.
• Monitor for service crashes, unexpected restarts, or availability interruptions, and validate updates in a controlled maintenance window.
• Review vendor advisories from Festo and CODESYS and apply security updates promptly.

Evidence notes

This debrief follows the supplied CISA CSAF advisory content and the advisory title "CODESYS in Festo Automation Suite." The description explicitly states that CODESYS Gateway V3 before 3.5.17.10 can suffer a NULL pointer dereference from crafted communication requests, resulting in denial of service. The revision history shows an initial CISA publication on 2026-02-26 and a CISA republication on 2026-03-17 of the vendor advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.