CISA + vendors
ICS Advisories
Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.
1
Found
Advisory data: live connection— last retrieved: 7 November 2026 at 02:05.
Filters
1 active1 advisories found
FSA-202202
Festo: Controller CECC-S,LK,D family <= 2.3.8.1 - multiple vulnerabilities in CODESYS V3 runtime system
Published
18 July 2022
Last update
3 November 2025
Linked CVEs
Affected sectors
Energieopwekking
Risk evaluation
The Festo controller CECC product family is affected by multiple vulnerabilities in the CODESYS V3 runtime.
Mitigation summary
For CVE-2019-5105, CVE-2019-9011, CVE-2019-9013, CVE-2020-10245, CVE-2020-12067, CVE-2020-12068, CVE-2020-12069, CVE-2020-15806, CVE-2021-29241, CVE-2021-29242, CVE-2021-33485, CVE-2021-36763, CVE-2021-36764, CVE-2022-22513, CVE-2022-22514, CVE-2022-22515, CVE-2022-22517, CVE-2022-22519: No fix planned. This issue will be handled with next hardware generation release.
Revision history (4)
Initial publication — 18 July 2022
Initial revision.
Update A — 11 January 2024
Adjust link to VDE Advisory, TLP and update some CVE information, where CVSS was not known before.
Update B — 28 July 2025
Adjusted to VDE template. Changed title from 'Festo Controller CECC-S,-LK,-D Family Firmware <= 2.3.8.1 - Multiple Vulnerabilities in CODESYS V3 Runtime System' to 'Festo: Controller CECC-S,LK,D family <= 2.3.8.1 - multiple vulnerabilities in CODESYS V3 runtime system'. Updated legal disclaimer to add references to special provisions.
Update C — 3 November 2025
Add missing CWE values for vulnerabilities. Add missing CVSS 3.0 score for CVE-2010-5250.