Festo Automation Suite heap overflow enables remote code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Heap buffer overflow in Wibu CodeMeter Runtime affects Festo automation products; remote code execution possible, no active exploitation reported.
CISA has published an advisory on a critical out-of-bounds write vulnerability (CVE-2023-3935) in Wibu CodeMeter Runtime up to version 7.60b, which is used by multiple Festo and Festo Didactic products. The vulnerability has a CVSS score of 9.8 and allows an unauthenticated remote attacker to execute arbitrary code and gain full system control with no user interaction required. Affected products include CIROS Studio/Education (versions 6.0.0–6.4.6 and 7.0.0–7.1.7), Festo Automation Suite (≤2.6.0.481), FluidDraw (P6 ≤6.2k, 365 ≤7.0a), FluidSIM 5 (all versions) and 6 (≤6.1c), and MES-PC (shipped before December 2023).
These products are widely deployed in critical manufacturing environments worldwide. Mitigation requires updating Wibu CodeMeter Runtime to version 7.60c or later for most products; Automation Suite requires a planned fix in summer 2024. CISA has not received reports of active exploitation in the wild. Organizations should immediately prioritize network segmentation, limit remote access to affected systems, and apply patches as they become available.
Mentioned in this report
Detection guidance
Wibu CodeMeter Runtime Spawning Shell or Scripting Child Process
CodeMeter.exe (Wibu CodeMeter Runtime server, CVE-2023-3935 heap overflow) spawning a command shell, script host or LOLBin, which indicates possible remote code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Wibu CodeMeter Runtime Spawning Shell or Scripting Child Process
description: Detects the Wibu CodeMeter Runtime server (CodeMeter.exe) spawning command
interpreters, script hosts or common LOLBins. CodeMeter is a license service embedded
in Festo and other ICS engineering products and does not normally launch shells,
so a child process like this suggests exploitation of a memory corruption flaw such
as CVE-2023-3935. The rule matches the parent/child relation, not any specific payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \CodeMeter.exe
- \CodeMeterCC.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \wmic.exe
- \curl.exe
condition: selection
falsepositives:
- Vendor installer or update routines that briefly invoke cmd.exe from the CodeMeter
service during an upgrade
- Administrators launching CodeMeter Control Center helper scripts
level: high
id: 720c378b-29b3-533e-84cc-1120c548a0bf
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-02
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs