CVE-2021-34596 Unknown Vendor CVE debrief

Who should care

Industrial control and automation teams running CODESYS-based runtimes, especially Festo Automation Suite deployments that include bundled or externally installed CODESYS components. OT operators, engineers, and defenders responsible for network-reachable control environments should prioritize review.

Technical summary

The flaw is an uninitialized-pointer read in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT versions prior to V2.4.7.56. The supplied advisory states that a crafted request can cause the read, leading to denial of service. The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, so the main impact is availability and the attack does not require user interaction.

Defensive priority

Medium — prioritize patching and version verification in any environment that exposes the affected CODESYS runtime components, because the issue is network-reachable and can cause service disruption.

Recommended defensive actions

• Update CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT to version V2.4.7.56 or later.
• Download the latest patched CODESYS release directly from the official CODESYS website and follow the vendor’s installation/update instructions.
• If you use Festo Automation Suite, move to supported updates where CODESYS is no longer bundled and keep the Festo connector up to date.
• Inventory systems that run bundled or separately installed CODESYS components and confirm whether they are on affected versions.
• Monitor CODESYS and Festo security advisories and apply updates promptly in maintenance windows.

Evidence notes

Primary evidence comes from CISA CSAF advisory ICSA-26-076-01, published 2026-02-26 and republished 2026-03-17. The advisory text states that a crafted request can cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to V2.4.7.56, resulting in denial of service. Remediation guidance in the source is limited to vendor patching and Festo Automation Suite update/packaging notes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.