CVE-2020-14519 Unknown Vendor CVE debrief

Who should care

Organizations using Festo Automation Suite, especially installations that include affected CODESYS/CodeMeter components or expose browser-accessed web server workflows. OT and industrial automation teams should prioritize review if the WebSockets API remains enabled or if the environment depends on license-file integrity.

Technical summary

The advisory describes abuse of CodeMeter’s internal WebSockets API via a specifically crafted JavaScript payload. Affected scope includes all versions prior to 7.00, and version 7.0 or newer if the affected WebSockets API is still enabled. CISA notes the issue is especially relevant where a web browser is used to access a web server, and that license-file alteration/creation can occur when this issue is combined with CVE-2020-14515.

Defensive priority

High

Recommended defensive actions

• Update Festo Automation Suite to version 2.8.0.138 or later, where CODESYS is no longer bundled.
• Install the latest patched CODESYS version directly from the official CODESYS website.
• Follow the vendor-provided installation and update instructions to ensure security fixes are applied.
• Review whether the affected CodeMeter WebSockets API is enabled on any version 7.0 or newer systems and reduce exposure where it is not required.
• Keep the Festo Automation Suite connector up to date by applying Festo-released updates promptly.
• Monitor official CODESYS and Festo security advisories for follow-on fixes or related issues such as CVE-2020-14515.

Evidence notes

Source evidence comes from CISA’s CSAF advisory ICSA-26-076-01 (source item URL provided) and its listed references to Festo, CODESYS, and CISA advisory pages. The advisory text explicitly states that all versions prior to 7.00 are affected, including version 7.0 or newer when the affected WebSockets API remains enabled, and that crafted JavaScript may alter or create license files when combined with CVE-2020-14515. Timing context is taken from the supplied advisory dates: published 2026-02-26 and modified 2026-03-17.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.