PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-47382 Schneider Electric CVE debrief

CISA published ICSA-26-076-01 on 2026-02-26 and republished the vendor advisory on 2026-03-17. The advisory describes a stack-based out-of-bounds write in the CmpTraceMgr component used by multiple CODESYS products. In affected Festo Automation Suite/CODESYS combinations, an authenticated remote attacker could corrupt stack memory, causing denial of service, memory overwriting, or potentially remote code execution.

Vendor
Schneider Electric
Product
HMISCU Controller
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2023-07-11
Original CVE updated
2026-01-20
Advisory published
2023-07-11
Advisory updated
2026-01-20

Who should care

OT and industrial automation teams running Festo Automation Suite, especially systems that include the listed CODESYS Development System versions or allow authenticated remote maintenance access.

Technical summary

The issue is a stack-based out-of-bounds write consistent with CWE-787 in the CmpTraceMgr component. Because the vulnerable component is used by multiple CODESYS products, impacted Festo Automation Suite installations can be exposed through bundled or separately installed CODESYS components. The advisory lists affected combinations including Festo Automation Suite versions below 2.8.0.138 and specific bundled CODESYS Development System versions. The attacker must be authenticated, but the impact can include stack corruption, process failure, and possible remote code execution.

Defensive priority

High. Prioritize remediation on any reachable or maintenance-accessible Festo/CODESYS engineering system, since the issue can lead to memory corruption and possible RCE.

Recommended defensive actions

  • Upgrade affected Festo Automation Suite installations to version 2.8.0.138 or later.
  • Install the latest patched CODESYS release directly from the official CODESYS website, following vendor instructions.
  • Inventory systems that use the affected CODESYS Development System versions and confirm whether they are bundled or separately installed.
  • Monitor Festo PSIRT and CODESYS security advisories and apply updates promptly.
  • Review and restrict authenticated remote access to engineering and maintenance systems to only necessary accounts.
  • Keep the Festo Automation Suite connector updated with the latest Festo-released updates.

Evidence notes

This debrief is based on the CISA CSAF republished advisory (ICSA-26-076-01) and its referenced vendor sources. The source metadata contains a vendor/product attribution inconsistency in the prompt, so the debrief relies on the advisory title and body text: 'CODESYS in Festo Automation Suite.' Publication timing is taken from the supplied advisory dates: 2026-02-26 initial publication and 2026-03-17 CISA republication. No KEV entry was supplied.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-47382 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-47382

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-47382 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-47382

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-020-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.se.com/us/en/download/document/7EN52-0390/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-020-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.