CODESYS Runtime Vulnerability in Festo Automation Suite Enables Unauthenticated Code Execution

This advisory identifies a critical remote code execution vulnerability in the CODESYS runtime environment as shipped within Festo's industrial automation platform. The vulnerability appears to reside in core runtime components rather than application-level code, making it a supply-chain amplification risk—any organization deploying Festo Automation Suite with the affected CODESYS versions is exposed without additional mitigations.

The affected version matrix reveals concerning deployment patterns: versions prior to 2.8.0.138 across multiple CODESYS generations (3.0 through 3.5.16.10) are vulnerable, and notably version 2.8.0.137 is explicitly listed as affected. This suggests the vulnerability persisted across multiple maintenance cycles. The unauthenticated nature of the exploit vector is particularly severe in OT environments where these systems often operate on industrial networks with implicit trust assumptions.

Festo Automation Suite is deployed across manufacturing, pharmaceutical, automotive, and food-processing sectors. The CODESYS runtime is fundamental to PLC programming and execution, meaning exploitation could yield persistent control over production systems, safety-critical processes, and data collection infrastructure. Attackers could manipulate industrial processes, exfiltrate production data, or establish persistent footholds in critical infrastructure.

Defenders should immediately inventory deployments of Festo Automation Suite and CODESYS installations, prioritizing production environments. Organizations must upgrade to Festo Automation Suite 2.8.0.138 or later without delay. Network segmentation isolating OT environments from untrusted networks should be enforced as interim mitigation. Monitor for suspicious runtime behavior, unexpected network connections from PLC systems, and anomalous process modifications.

Broader implications: This vulnerability exemplifies supply-chain risk in ICS ecosystems where embedded runtime components from third-party vendors become de facto attack surface. The CODESYS ecosystem's ubiquity in industrial automation amplifies impact potential. Organizations should reassess dependency chains for embedded runtime components and consider requiring security audits and vulnerability disclosure agreements for critical OT software suppliers.