PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-14517 Unknown Vendor CVE debrief

CVE-2020-14517 is a critical network-exposed weakness in CodeMeter protocol encryption. According to the advisory, CodeMeter versions prior to 6.90 are affected, and version 6.90 or newer is also affected when CodeMeter Runtime is running as a server and accepts external connections. In the CISA-republished Festo advisory, this condition is tied to Festo Automation Suite deployments that bundle CODESYS components, making exposed OT/engineering systems a high-priority target for patching and network containment.

Vendor
Unknown Vendor
Product
FESTO
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-26
Original CVE updated
2026-03-17
Advisory published
2026-02-26
Advisory updated
2026-03-17

Who should care

OT and ICS administrators, Festo Automation Suite users, CODESYS/CodeMeter operators, industrial engineering teams, and network defenders responsible for systems that may expose CodeMeter Runtime to external connections.

Technical summary

The source advisory states that CodeMeter protocol encryption can be easily broken, allowing an attacker to remotely communicate with the CodeMeter API. The impacted scope includes all CodeMeter versions before 6.90, and 6.90+ when Runtime runs as a server and accepts external connections. The CISA source maps the issue to Festo Automation Suite installations associated with bundled CODESYS development system components, including versions below 2.8.0.138.

Defensive priority

Critical. Treat as urgent for any environment where CodeMeter Runtime is reachable from untrusted networks or where Festo Automation Suite/CODESYS components are deployed on engineering or OT assets.

Recommended defensive actions

  • Upgrade Festo Automation Suite to version 2.8.0.138 or later.
  • Install the latest patched CodeMeter/CODESYS releases directly from the official CODESYS website.
  • Verify that CodeMeter Runtime is not exposed as a server to external networks unless there is a documented business need.
  • Restrict and segment network access to engineering and OT systems that use CodeMeter.
  • Monitor official Festo and CODESYS security advisories and apply updates promptly.
  • Keep the Festo Automation Suite connector up to date using vendor-released updates.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-076-01, which republishes Festo SE & Co. KG advisory FSA-202601, plus the linked official Festo, CERTVDE, CISA, CVE.org, and NVD references. The supplied record’s vendor mapping is low-confidence/needs-review, so the product attribution should be treated cautiously and anchored to the source advisory text.

Sources and references

Verified primary and authoritative sources

  • CVE-2020-14517 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2020-14517

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2020-14517 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2020-14517

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/vendor/festo/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.festo.com/psirt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/VDE-2025-108

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cve.org/CVERecord?id=CVE-2025-2595

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.