CVE-2019-13538 Unknown Vendor CVE debrief

Who should care

Organizations using CODESYS V3 Library Manager or products that bundle it, especially Festo Automation Suite deployments that include affected CODESYS components. Engineering teams that exchange or deploy libraries in industrial automation workflows should also care, particularly where source libraries are used.

Technical summary

According to the source advisory, CODESYS V3 Library Manager versions prior to 3.5.16.0 do not verify library validity before presenting active library content. That creates a path for manipulated libraries to be displayed, and potentially executed, when a user opens or works with them. The advisory identifies the issue as affecting both compiled and source libraries, while strongly recommending distribution of compiled libraries only. The supplied source ties the advisory to Festo Automation Suite packaging, but the underlying flaw is in the CODESYS component itself.

Defensive priority

High. The CVSS score is 8.6 and the source describes a condition that can lead to execution of manipulated content. Remediation should focus on upgrading affected CODESYS components and removing any dependence on vulnerable bundled versions.

Recommended defensive actions

• Update CODESYS V3 Library Manager to version 3.5.16.0 or later.
• If using Festo Automation Suite, install the latest FAS release and follow Festo's connector update guidance.
• Download patched CODESYS releases only from the official CODESYS website.
• Apply vendor installation and update instructions to ensure all security fixes are present.
• Monitor CODESYS security advisories and deploy updates promptly.
• Prefer compiled libraries over source libraries when distributing libraries in operational environments.

Evidence notes

Source evidence comes from the CISA CSAF advisory ICSA-26-076-01 and its revision history, which lists an initial publication on 2026-02-26 and a CISA republication on 2026-03-17. The advisory description states that all versions of CODESYS V3 Library Manager prior to 3.5.16.0 are affected. The source metadata also links the issue to Festo Automation Suite packaging, but the core vulnerability text attributes the flaw to 3S-Smart Software Solutions GmbH CODESYS V3 Library Manager. The vendor field in the supplied corpus is low-confidence and flagged for review, so this debrief avoids asserting a stronger product-vendor relationship than the source supports.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.