CVE-2021-36765 Unknown Vendor CVE debrief

Who should care

OT/ICS operators, Festo Automation Suite administrators, and engineers running CODESYS Control runtime systems or EtherNet/IP-enabled industrial environments should care most. Network defenders responsible for segmentation, exposure reduction, and patch management on industrial networks should also review this advisory.

Technical summary

The supplied advisory states that specific EtherNet/IP requests can cause a null pointer dereference in a downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system. The affected CODESYS EtherNetIP component is identified as being before 4.1.0.0. The remediation notes indicate that starting with Festo Automation Suite 2.8.0.138, CODESYS is no longer bundled and must be downloaded and installed separately, and users should obtain the latest patched CODESYS release directly from the official CODESYS website.

Defensive priority

High priority for environments that use CODESYS-based industrial automation and have any network exposure to EtherNet/IP traffic. The issue is network-triggerable and can impact runtime availability, so it should be scheduled promptly for inventory, validation, and patch deployment.

Recommended defensive actions

• Inventory Festo Automation Suite and CODESYS installations, then identify any systems using CODESYS EtherNetIP before 4.1.0.0.
• Upgrade to the latest patched CODESYS release from the official CODESYS website.
• Update Festo Automation Suite to 2.8.0.138 or later and keep the FAS connector current.
• Limit EtherNet/IP exposure to trusted industrial network segments and review firewall or segmentation controls.
• Follow CISA ICS recommended practices and apply updates through a controlled maintenance process.

Evidence notes

The source corpus is the CISA CSAF advisory ICSA-26-076-01 and its referenced materials. The advisory metadata names CODESYS EtherNetIP before 4.1.0.0 and describes a null pointer dereference triggered by specific EtherNet/IP requests. The remediation text says Festo Automation Suite 2.8.0.138 no longer bundles CODESYS and directs customers to obtain patched CODESYS releases from the official vendor. The supplied CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while the narrative description emphasizes a crash-prone null pointer dereference; that source inconsistency is noted here rather than resolved. Vendor attribution in the prompt is low confidence, so this debrief focuses on the exposed product chain rather than a vendor guess.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.