CVE-2023-49676 CODESYS CVE debrief

Who should care

OT administrators, automation engineers, and security teams supporting Festo Automation Suite or CODESYS Development System installations should care most. This is especially important where engineering project files may be exchanged with third parties or handled on shared workstations.

Technical summary

The advisory describes a local, user-interaction-required use-after-free condition with no confidentiality or integrity impact and high availability impact (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). The practical risk is disruption: opening a corrupted project file can crash the affected system. The supplied advisory scope includes Festo Automation Suite versions below 2.8.0.138 and related CODESYS Development System components named in the CSAF record.

Defensive priority

Medium. Prioritize patching on engineering and OT workstations because the issue can interrupt availability and requires only a user to open a malicious or corrupted project file. Raise priority if your environment regularly imports files from less-trusted sources.

Recommended defensive actions

• Upgrade Festo Automation Suite to version 2.8.0.138 or later where applicable.
• Install the latest patched CODESYS release directly from the official CODESYS website.
• Follow the vendor's installation and update instructions so all security fixes are applied.
• Keep the Festo Automation Suite connector current by applying FAS updates as they are released.
• Review file-handling workflows for project files from external or untrusted sources and isolate or scan them before opening.
• Monitor Festo PSIRT, CERT@VDE, and CISA advisories for bundle and component updates.

Evidence notes

Primary evidence comes from the CISA CSAF source item for ICSA-26-076-01, which republishes the Festo advisory and explicitly describes the use-after-free crash scenario, the user-interaction requirement, and the affected Festo/CODESYS product scope. The supplied metadata also lists the CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H and the CWE-416 reference. Vendor attribution in the prompt metadata is low-confidence and marked for review, so this debrief relies on the advisory text and official links rather than the placeholder vendor object.

Official resources