CVE-2022-22514 Festo CVE debrief

Who should care

Organizations running Festo Automation Suite versions below 2.8.0.138, especially installations that include the bundled CODESYS Development System components identified in the advisory. OT/ICS operators, engineering workstation administrators, and patch managers should prioritize systems that expose authenticated remote access paths.

Technical summary

The advisory states that an authenticated, remote attacker can access a dereferenced pointer contained in a request. That access may lead to local memory overwrite in CmpTraceMgr. The corpus further notes that the attacker cannot control the values read internally or the values written, but invalid memory access can result in a crash. The supplied CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) is consistent with a network-reachable, low-complexity issue requiring privileges.

Defensive priority

High. The issue is remotely reachable after authentication and can affect availability, with potential integrity impact. The source corpus does not indicate known exploitation or KEV listing, but the combination of network exposure and crash/memory-corruption behavior warrants prompt remediation.

Recommended defensive actions

• Upgrade Festo Automation Suite to version 2.8.0.138 or later.
• Install the latest patched CODESYS release directly from the official CODESYS website, following vendor update guidance.
• Keep the Festo Automation Suite connector updated with the latest FAS releases from Festo.
• Review which systems expose authenticated remote access to affected engineering or automation components and limit access where possible.
• Monitor Festo and CODESYS security advisories and apply future updates promptly.

Evidence notes

This debrief is based on CISA’s CSAF republication (ICSA-26-076-01) of the Festo SE & Co. KG advisory FSA-202601 and the CVE record links provided in the corpus. The advisory text explicitly describes authenticated remote access, dereferenced-pointer access, local memory overwrite in CmpTraceMgr, and possible crashes on invalid memory access. The corpus does not include KEV listing, known ransomware use, or confirmed exploitation details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.