PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-30187 Unknown Vendor CVE debrief

CVE-2021-30187 is a medium-severity command-injection issue in CODESYS V2 runtime system SP before 2.4.7.55. In the CISA-republished advisory, the issue is tied to Festo Automation Suite deployments that include CODESYS components. The published CVSS vector indicates local exploitation with low privileges and no user interaction, which makes this primarily an OT engineering-workstation risk rather than a remote exposure event. Festo's remediation guidance says Festo Automation Suite 2.8.0.138 no longer bundles CODESYS, and customers should install patched CODESYS directly and keep the FAS connector updated.

Vendor
Unknown Vendor
Product
FESTO
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-26
Original CVE updated
2026-03-17
Advisory published
2026-02-26
Advisory updated
2026-03-17

Who should care

OT administrators, ICS/automation engineers, and patch-management teams supporting Festo Automation Suite installations that include CODESYS components, especially on engineering workstations.

Technical summary

The advisory describes improper neutralization of special elements used in an OS command (CWE-78) in CODESYS V2 runtime system SP before 2.4.7.55. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L with a score of 5.3. CISA's republished CSAF associates the issue with Festo Automation Suite environments and points to vendor guidance to separate CODESYS from the suite and apply the latest patched release.

Defensive priority

Medium priority, with higher urgency if Festo Automation Suite is deployed and local users or service accounts can interact with CODESYS-related runtime components.

Recommended defensive actions

  • Inventory Festo Automation Suite installations and identify any systems that include CODESYS components.
  • Update CODESYS to a version that is not affected by the advisory; the source states the vulnerable CODESYS V2 runtime system SP is before 2.4.7.55.
  • Upgrade Festo Automation Suite to 2.8.0.138 or later, since the source notes CODESYS is no longer bundled starting with 2.8.0.138.
  • Follow the official CODESYS installation and update instructions so security fixes are actually applied.
  • Keep the Festo Automation Suite connector current and monitor CODESYS security advisories for follow-on fixes.
  • Limit local interactive access on engineering workstations and review privileges for accounts that can reach CODESYS runtime functions.

Evidence notes

Evidence in the supplied corpus comes from CISA's CSAF republishing Festo SE & Co. KG advisory ICSA-26-076-01. The source describes CVE-2021-30187 as 'CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.' The remediation text explicitly says Festo Automation Suite version 2.8.0.138 no longer bundles CODESYS. The supplied vendor metadata is low-confidence and inconsistent, so asset identification should rely on the advisory text rather than the vendor label.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-30187 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-30187

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-30187 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-30187

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/vendor/festo/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.festo.com/psirt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/VDE-2025-108

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cve.org/CVERecord?id=CVE-2025-2595

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.