CISA + vendors
ICS Advisories
Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.
1
Found
Advisory data: live connection— last retrieved: 7 November 2026 at 02:05.
Filters
1 active1 advisories found
FSA-202208
Festo: Multiple Festo products contain an unsafe default Codesys configuration
Published
29 November 2022
Last update
28 October 2025
Linked CVEs
Affected sectors
Risk evaluation
The products are shipped with an unsafe configuration of the integrated CODESYS Runtime environment. In this case no default password is set to the CODESYS PLC and therefore access without authentication is possible. With a successful established connection to the CODESYS Runtime the PLC-Browser commands are available. Thus granting the possibilities to e.g. read and modify the configuration file(s), start/stop the application and reboot the device.
Mitigation summary
Festo has identified the following compensatory measures to reduce the risk: - For CVE-2022-22515: Using the online user management prevents an attacker from downloading and execute malicious code, but also suppresses start, stop, debug, or other actions on a known working application that could potentially disrupt a machine or system.
Revision history (3)
Initial publication — 29 November 2022
Initial revision.
Update A — 11 January 2024
Adjust link to VDE Advisory
Update B — 28 October 2025
Adjusted to VDE template. Changed title from "Multiple Festo products contain an unsafe default Codesys configuration" to "Festo: Multiple Festo products contain an unsafe default Codesys configuration". Updated legal disclaimer to add references to special provisions.