CVE-2021-34593 Unknown Vendor CVE debrief

Who should care

OT/ICS security teams, PLC engineers, and administrators responsible for Festo Automation Suite environments or any system using the affected CODESYS V2 Runtime Toolkit / PLCWinNT components. Organizations that expose PLC management or communication services should treat this as an operational availability risk.

Technical summary

The advisory describes a network-reachable, unauthenticated denial-of-service condition in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT before V2.4.7.56. The impact is availability-only: malformed requests can stop PLC execution, cause memory leakage, or interfere with communication clients. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H aligns with remote, no-auth disruption to industrial control availability.

Defensive priority

High. The issue is easy to reach over the network, requires no authentication, and can directly disrupt PLC operation or communications. For OT environments, even availability-only failures can have safety and production consequences.

Recommended defensive actions

• Inventory Festo Automation Suite installations and identify any systems using CODESYS V2 Runtime Toolkit 32 Bit full or PLCWinNT components.
• Upgrade to a version at or above Festo Automation Suite 2.8.0.138, and obtain the latest patched CODESYS release directly from the official CODESYS source as directed in the advisory.
• Verify that any separately installed CODESYS components are updated to a version at or above V2.4.7.56.
• Apply Festo connector updates as they are released and follow the vendor update guidance in the advisory.
• Review network exposure to PLC communication services and restrict access to trusted engineering and control networks where possible.
• Monitor official vendor and CISA advisories for follow-up guidance and validate PLC behavior after patching.

Evidence notes

All factual claims are limited to the supplied CISA CSAF advisory and the CVE metadata. The advisory states that unauthenticated crafted invalid requests can cause denial-of-service conditions in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT before V2.4.7.56, including stopped PLC programs, memory leakage, and blocked communication clients. The advisory metadata also lists Festo Automation Suite versions and bundled CODESYS components, remediation guidance, and the CISA publication timeline of 2026-02-26 with a 2026-03-17 republication.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.