# Festo Automation Suite heap overflow enables remote code execution

Published: 2025-07-01 · Severity: elevated · Sectors: manufacturing, infrastructure
Canonical: https://vorant.io/reports/11f3bc14-9274-5d15-929f-170d57234bdd/festo-automation-suite-heap-overflow-enables-remote-code-execution

> Heap buffer overflow in Wibu CodeMeter Runtime affects Festo automation products; remote code execution possible, no active exploitation reported.

CISA has published an advisory on a critical out-of-bounds write vulnerability (CVE-2023-3935) in Wibu CodeMeter Runtime up to version 7.60b, which is used by multiple Festo and Festo Didactic products. The vulnerability has a CVSS score of 9.8 and allows an unauthenticated remote attacker to execute arbitrary code and gain full system control with no user interaction required. Affected products include CIROS Studio/Education (versions 6.0.0–6.4.6 and 7.0.0–7.1.7), Festo Automation Suite (≤2.6.0.481), FluidDraw (P6 ≤6.2k, 365 ≤7.0a), FluidSIM 5 (all versions) and 6 (≤6.1c), and MES-PC (shipped before December 2023).

These products are widely deployed in critical manufacturing environments worldwide. Mitigation requires updating Wibu CodeMeter Runtime to version 7.60c or later for most products; Automation Suite requires a planned fix in summer 2024. CISA has not received reports of active exploitation in the wild. Organizations should immediately prioritize network segmentation, limit remote access to affected systems, and apply patches as they become available.

## Mentioned in this report

- Vulnerabilities: CVE-2023-3935

## Detection guidance (public sample)

### Wibu CodeMeter Runtime Spawning Shell or Scripting Child Process

ATT&CK: T1190

CodeMeter.exe (Wibu CodeMeter Runtime server, CVE-2023-3935 heap overflow) spawning a command shell, script host or LOLBin, which indicates possible remote code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Wibu CodeMeter Runtime Spawning Shell or Scripting Child Process
description: Detects the Wibu CodeMeter Runtime server (CodeMeter.exe) spawning command
  interpreters, script hosts or common LOLBins. CodeMeter is a license service embedded
  in Festo and other ICS engineering products and does not normally launch shells,
  so a child process like this suggests exploitation of a memory corruption flaw such
  as CVE-2023-3935. The rule matches the parent/child relation, not any specific payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \CodeMeter.exe
    - \CodeMeterCC.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \wmic.exe
    - \curl.exe
  condition: selection
falsepositives:
- Vendor installer or update routines that briefly invoke cmd.exe from the CodeMeter
  service during an upgrade
- Administrators launching CodeMeter Control Center helper scripts
level: high
id: 720c378b-29b3-533e-84cc-1120c548a0bf
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-02
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/11f3bc14-9274-5d15-929f-170d57234bdd/festo-automation-suite-heap-overflow-enables-remote-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup