PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3735 OpenSSL Software Foundation CVE debrief

CVE-2017-3735 is described as a one-byte overread while parsing the IPAddressFamily extension in an X.509 certificate, which can lead to incorrect certificate text display. In the supplied CISA CSAF advisory, the CVE is republished under "CODESYS in Festo Automation Suite," with remediation focused on updating Festo Automation Suite and installing patched CODESYS builds. The source corpus contains a product-mapping inconsistency, so the Festo/CODESYS association should be treated as low-confidence and reviewed.

Vendor
OpenSSL Software Foundation
Product
FESTO
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-09-30
Original CVE updated
2025-11-13
Advisory published
2025-09-30
Advisory updated
2025-11-13

Who should care

Teams running Festo Automation Suite, CODESYS Development System users, and industrial-control-system operators who rely on certificate parsing, software updates, or bundled engineering-tool components.

Technical summary

The provided CVE description states that parsing the IPAddressFamily extension in an X.509 certificate can trigger a one-byte overread, resulting in an incorrect text display of the certificate. The source advisory maps this CVE to Festo Automation Suite and CODESYS components, including versions before 2.8.0.138 and listed bundled CODESYS builds, and recommends moving to Festo Automation Suite 2.8.0.138 or later plus patched CODESYS releases. The supplied CVSS vector indicates low integrity impact and no confidentiality or availability impact.

Defensive priority

Medium priority: the supplied CVSS score is 5.3, and the described effect is limited, but the issue touches certificate handling in industrial software and should still be patched promptly.

Recommended defensive actions

  • Inventory Festo Automation Suite and CODESYS installations, especially the versions listed in the advisory.
  • Upgrade Festo Automation Suite to version 2.8.0.138 or later.
  • Download and install the latest patched CODESYS release directly from the official CODESYS website.
  • Follow CODESYS installation and update instructions to ensure security fixes are applied.
  • Keep the Festo Automation Suite connector current and monitor Festo and CODESYS security advisories.

Evidence notes

The source corpus includes two overlapping but not fully consistent narratives: the CVE text describes an OpenSSL X.509 certificate parsing overread, while the CISA CSAF advisory title and product list map CVE-2017-3735 to Festo Automation Suite and CODESYS. Because no additional corpus is available, this debrief preserves both facts and flags the product association as low confidence. The published and modified dates supplied in the timeline are used only as advisory timing context, not as the underlying bug date.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-3735 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-3735

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-3735 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-3735

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/vendor/festo/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.festo.com/psirt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/VDE-2025-108

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cve.org/CVERecord?id=CVE-2025-2595

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.