PatchSiren cyber security CVE debrief

CVE-2018-20025 Kaspersky Lab CVE debrief

CVE-2018-20025 is a high-severity weakness in CODESYS V3 products prior to version 3.5.14.0 involving insufficiently random values. In the CISA-republished Festo advisory, the issue is associated with CODESYS components used in Festo Automation Suite deployments. The published CVSS vector indicates a network-reachable issue with no privileges or user interaction required and high confidentiality impact.

Vendor: Kaspersky Lab
Product: FESTO
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-09-30
Original CVE updated: 2025-11-13
Advisory published: 2025-09-30
Advisory updated: 2025-11-13

Who should care

Security, engineering, and operations teams running CODESYS V3 products older than 3.5.14.0, especially installations that include CODESYS Development System components in Festo Automation Suite. OT/ICS defenders managing exposed engineering workstations or update pipelines should prioritize review.

Technical summary

The advisory describes a use of insufficiently random values condition in CODESYS V3 products before 3.5.14.0. The published CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which reflects network attackability, no required privileges, no user interaction, and high confidentiality impact. The source material also maps the issue to CWE-330 and notes affected Festo Automation Suite versions that bundled CODESYS components.

Defensive priority

High priority for any environment using affected CODESYS V3 releases, especially OT/ICS systems and Festo Automation Suite installations. Because the issue is network-reachable and requires no user interaction or privileges, patch and exposure review should be expedited.

Recommended defensive actions

Update CODESYS to the latest patched version from the official CODESYS website.
Upgrade Festo Automation Suite to version 2.8.0.138 or later, where CODESYS is no longer bundled.
For installations with earlier Festo Automation Suite versions, review the installed CODESYS component version and apply vendor update guidance promptly.
Monitor CODESYS security advisories and apply security updates as soon as they are released.
Follow CISA ICS recommended practices and defense-in-depth guidance for industrial control systems.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-076-01 and its included Festo reference material. The advisory title is 'CODESYS in Festo Automation Suite,' and the description explicitly states: 'Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.' The remediation text in the source calls for downloading the latest patched CODESYS version directly from the official CODESYS website and maintaining Festo Automation Suite updates, including version 2.8.0.138 or later. Timeline context in the supplied corpus shows initial publication on 2026-02-26 and republication on 2026-03-17.

Sources and references

Verified primary and authoritative sources

CVE-2018-20025 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2018-20025

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2018-20025 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2018-20025

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json

Reference
Source reference
Unverified legacy reference

URL: https://certvde.com/en/advisories/vendor/festo/

Reference
Source reference
Unverified legacy reference

URL: https://www.festo.com/psirt

Reference
Source reference
Unverified legacy reference

URL: https://certvde.com/en/advisories/VDE-2025-108

Reference
Source reference
Unverified legacy reference

URL: https://www.cve.org/CVERecord?id=CVE-2025-2595

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.