CVE-2023-49675 CODESYS CVE debrief

Who should care

OT operators, automation engineers, and IT/OT security teams that use Festo Automation Suite or manage CODESYS-based engineering workstations should prioritize this. It matters most where users routinely open project files from external, shared, or otherwise untrusted sources.

Technical summary

The source advisory describes an out-of-bounds write in the handling of corrupted project files. Exploitation requires local access plus user interaction: an attacker must trick a user into opening a malicious project file. In affected environments, the flaw can result in code execution with the user's privileges or a system crash. The corpus lists Festo Automation Suite versions below 2.8.0.138 and several related CODESYS Development System versions/combinations as affected, and it notes that starting with Festo Automation Suite 2.8.0.138, CODESYS is no longer bundled and must be obtained separately.

Defensive priority

High for affected engineering workstations and OT environments. Prioritize remediation wherever project files may be received from outside the trusted environment.

Recommended defensive actions

• Update Festo Automation Suite to version 2.8.0.138 or later, or the latest vendor-patched release referenced by Festo.
• Download and install the latest patched CODESYS release directly from the official CODESYS website if CODESYS is installed separately.
• Keep the Festo Automation Suite connector updated by applying Festo-released updates promptly.
• Review and monitor CODESYS security advisories and apply related security fixes without delay.
• Limit opening of untrusted or unexpected project files on engineering workstations and reinforce user awareness around malicious file delivery.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-076-01, which republishes Festo advisory FSA-202601. The source corpus lists the affected product area as Festo Automation Suite with CODESYS components and provides a remediation path centered on updating to 2.8.0.138 or later. Vendor attribution in the provided enrichment is low-confidence/needs-review, so the product naming should be treated as source-backed but reviewed if you need a stricter asset mapping.

Official resources