PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-29240 Unknown Vendor CVE debrief

CVE-2021-29240 affects the CODESYS Package Manager in CODESYS Development System 3 before 3.5.17.0. According to the CISA-republished Festo advisory, the package manager does not properly check package validity before installation, which can allow installation of CODESYS packages containing malicious content. In the Festo Automation Suite context, the advisory notes that CODESYS was bundled in earlier suite releases and later removed from the bundle starting with version 2.8.0.138, shifting customers to install CODESYS separately from the official source.

Vendor
Unknown Vendor
Product
FESTO
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-26
Original CVE updated
2026-03-17
Advisory published
2026-02-26
Advisory updated
2026-03-17

Who should care

OT/ICS administrators, automation engineers, and security teams responsible for Festo Automation Suite and CODESYS Development System deployments. Prioritize any environment where operators install or update CODESYS packages on engineering workstations or other trusted build/configuration systems.

Technical summary

The vulnerability is described as a package-validation weakness in the CODESYS Package Manager. The source advisory states that versions of CODESYS Development System 3 before 3.5.17.0 do not check the validity of packages before installation, creating an opportunity to install packages with malicious content. The supplied CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local execution context with user interaction and high potential impact if a malicious package is installed. The CISA CSAF source ties the issue to Festo Automation Suite deployments that include CODESYS components.

Defensive priority

High. The combination of user interaction, local installation flow, and high confidentiality/integrity/availability impact makes this a high-priority remediation item for engineering and OT environments.

Recommended defensive actions

  • Upgrade CODESYS Development System 3 to version 3.5.17.0 or later.
  • If you use Festo Automation Suite, upgrade to version 2.8.0.138 or later.
  • Download patched CODESYS releases only from the official CODESYS website and follow the vendor's installation and update instructions.
  • Keep the Festo Automation Suite connector up to date by applying Festo-released updates when available.
  • Review CODESYS security advisories regularly and apply updates promptly.

Evidence notes

Source item ICSA-26-076-01 states: 'The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODESYS packages with malicious content.' The same source lists remediation guidance to obtain patched CODESYS versions from the official website and notes that, starting with Festo Automation Suite 2.8.0.138, CODESYS is no longer bundled with the suite. The advisory metadata also includes the CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and a revision history showing initial publication on 2026-02-26 and republication on 2026-03-17.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-29240 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-29240

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-29240 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-29240

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/vendor/festo/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.festo.com/psirt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/VDE-2025-108

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cve.org/CVERecord?id=CVE-2025-2595

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.