In brief · As of October 2026
A Festo plant consists of CPX-E controllers (CODESYS runtime, EtherCAT master, PROFINET device), CPX-AP-I masters with AP modules on the AP bus, valve terminals (VTSA, MPA, VTUG) with bus nodes and CPX modules, CMMT drives and IO-Link devices behind AP IO-Link masters. From the maintenance PC, controller, bus nodes, AP masters and drives provide order code, serial number and firmware via PROFINET I&M0 or EtherNet/IP ListIdentity; the modules behind a PROFINET bus node appear as submodules per slot. AP modules on the AP bus, EtherCAT devices of a CPX-E and IO-Link sensors are only seen by the master: the web interface of the AP master, the Automation Suite or the IO-Link interface. Festo identifies via part number (567347) and order code (CPX-CEC-C1) and publishes as CSAF via CERT@VDE: 18 advisories, one new in 2026 with 126 CODESYS CVEs. Festo creates SBOMs for some products without providing them; for the plant you do not need one.
What hangs on a CPX controller and what of it is visible on the network
The controller is a CPX-E-CEC with CODESYS runtime, at the same time EtherCAT master and PROFINET or EtherNet/IP device. Attached are CPX-E modules on the local bus, EtherCAT devices (CMMT-AS drives, CPX-AP-I-EC masters with AP modules), valve terminals with bus nodes (CPX-FB36 PROFINET, CPX-FB38 EtherNet/IP) and their CPX modules, as well as IO-Link devices on CPX-AP-I-4IOL masters.
- Visible via IP from the maintenance PC: CPX-E-CEC, CPX bus nodes, CPX-AP-I-PN/EP masters and CMMT drives in PROFINET or EtherNet/IP variants via I&M0 or ListIdentity (order code, serial number, firmware); CPX-E additionally via OPC UA.
- Visible as submodules of the head: CPX modules behind a PROFINET bus node and AP modules behind a CPX-AP-I-PN master. The head reports them per slot, with I&M0 per module where it carries firmware.
- Only via the master: EtherCAT devices of the CPX-E (CMMT-EC, AP-I-EC) and IO-Link devices behind AP IO-Link masters. Their identity is provided by the Automation Suite, the web interface of the AP master or the IO-Link interface with VendorID, DeviceID and product name.
How AP modules, valve terminals and IO-Link devices get into the list: I&M0 per slot, AP master, Automation Suite
Behind PROFINET heads the scan is enough: I&M0 per slot provides the modules. For EtherCAT devices and IO-Link devices, the Festo Automation Suite shows the configuration online with type, order code, firmware and CODESYS version; the web interface of the AP master lists its modules and IO-Link ports. From the network, the following are added:
- Festo Automation Suite (CODESYS V3 plug-in): project with controller and module types, part number and the CODESYS version of the runtime.
- PROFINET I&M0 and EtherNet/IP Identity: CPX-E-CEC, CPX-AP-I bus interfaces and CMMT-AS drives answer, depending on the variant, via DCP/I&M0 or ListIdentity with order code, serial number and firmware.
- EtherCAT: CPX-E is an EtherCAT master; AP modules and CMMT drives in EtherCAT variants are only visible through it. IO-Link devices behind CPX-AP masters are reported by the master via its interface. Background in the article on the network scan.
- OPC UA on CPX-E-CEC (client and server) for controller type and software version.
How Festo publishes advisories and what matching runs on
On its PSIRT page, Festo refers to the “partner platform CERT@VDE” for all advisories; there is no provider under festo.com and no entry in the BSI aggregator. The CERT@VDE provider offers a ROLIE feed, index.txt and changes.csv.
| Measurement (7 Oct 2026) | Result |
|---|
| CSAF advisories in total | 18 (2021–2026) |
| of which 2026 new / updated | 1 (FSA-202601, Automation Suite, 126 CVEs) / 1 (FSA-202302 FactoryViews) |
| New documents 2022 / 2023 / 2024 / 2025 | 7 / 5 / 4 / 0 |
| CISA OT feed: entries mentioning Festo / with 2026 activity | 15 / 3 |
| Documents with CPE / PURL | 1 (software only) / 0 |
FSA-202601 shows the pattern of many CODESYS-based controllers: a wave of vulnerabilities in the runtime system hits the manufacturer as an integrator of CODESYS – and the plant builder as its customer, who has to know the CODESYS version of its CPX controller.
Festo provides both keys: the eight-digit part number as it appears in the order and in the ERP, and the descriptive order code as printed on the device – additionally as URIs Festo:Partnumber:… and Festo:Ordercode:…. A device list that carries only one of the two can still match; one that has only the product name cannot. More on this pattern in the article on creating an SBOM.
The software advisory FSA-202601 has to be run against the software inventory of the engineering PCs (Automation Suite, FactoryViews), not against the device list – and against the CODESYS version of the controllers, which should be in the list.
According to its CRA page, Festo creates SBOMs for some products, a handover to customers is not described; for the plant you do not need one.
What this means for installations with Festo components
- Record part number or order code and firmware for each CPX controller, AP module, valve terminal with bus node and CMMT drive.
- Carry the CODESYS version of the runtime per controller; CODESYS waves hit Festo, WAGO and others at the same time.
- Include Automation Suite and FactoryViews in the software inventory of the PCs.
A CODESYS wave hits Festo, WAGO and others at the same time, and whether your CPX-E is affected is decided by the runtime version, which is in no bill of materials. In Werkspilot Scan, Festo is stage 1 for controllers, bus nodes, PROFINET masters and their submodules via I&M0 and ListIdentity, and stage 3 for EtherCAT devices and IO-Link devices via controller and AP master. We are currently trialling the third stage with development partners on their plants.
All 13 manufacturers compared: SBOM by manufacturer →
Trial Werkspilot Scan on your own plant.
We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.
Ask about the development partnership →
Werkspilot keeps these devices per plant and reports when an advisory hits one of them. The figures in this article are our own measurements from 7 Oct 2026; manufacturers change feeds and pages without notice.
