CVE-2019-19789 Unknown Vendor CVE debrief

Who should care

OT/ICS teams running Festo Automation Suite, administrators responsible for bundled CODESYS components, automation engineers, and security teams managing engineering workstations or runtime systems that use CODESYS SP Realtime NT, Runtime Toolkit, or PLCWinNT.

Technical summary

The supplied advisory says the vulnerable code path can dereference a NULL pointer in affected CODESYS components prior to 3S-Smart CODESYS SP Realtime NT V2.3.7.28, CODESYS Runtime Toolkit 32 bit full V2.4.7.54, and CODESYS PLCWinNT V2.4.7.54. The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, which indicates a network-reachable issue requiring low privileges, no user interaction, and a high availability impact with no stated confidentiality or integrity impact. The Festo advisory context also states that starting with Festo Automation Suite 2.8.0.138, CODESYS is no longer bundled and must be installed and maintained separately.

Defensive priority

Medium priority. Treat it as an availability-focused OT issue and prioritize remediation where exposed or actively used CODESYS components remain below the fixed versions.

Recommended defensive actions

• Inventory Festo Automation Suite deployments and confirm whether any installation is older than 2.8.0.138.
• Check installed CODESYS component versions and verify they are at or above the fixed releases named in the advisory.
• Install the latest patched CODESYS version directly from the official CODESYS website, following vendor update instructions.
• Update the Festo Automation Suite connector and keep Festo security advisories under routine review.
• Plan and test updates during maintenance windows to minimize operational disruption in OT environments.

Evidence notes

This debrief is based on the supplied CISA CSAF source item ICSA-26-076-01, which republishes Festo advisory FSA-202601 for 'CODESYS in Festo Automation Suite.' The source description explicitly names the affected CODESYS components and the fixed version thresholds. The remediation text states that Festo Automation Suite 2.8.0.138 no longer bundles CODESYS and directs customers to install patched CODESYS separately. The supplied CVSS vector supports a denial-of-service / availability-only interpretation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.