Festo vulnerabilities
12 vulnerabilities
Known vulnerabilities in Festo products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 130 products.
Products
50 of 130- Controller Cecc X M15 vulnerabilities
- Controller Cecc X M1 Mv5 vulnerabilities
- Controller Cecc X M1 Mv S15 vulnerabilities
- Controller Cecc X M1 Y Yjkp5 vulnerabilities
- Controller Cecc X M1 Ys L15 vulnerabilities
- Controller Cecc X M1 Ys L25 vulnerabilities
- CECX X C1 Modular Master Controller With Codesys4 vulnerabilities
- CECX X M1 Modular Controller With Codesys And Softmotion4 vulnerabilities
- Controller CECC X M1 (4407603)4 vulnerabilities
- Controller CECC X M1 (8124922)4 vulnerabilities
- Controller CECC X M1 MV (4407605)4 vulnerabilities
- Controller CECC X M1 MV (8124923)4 vulnerabilities
- Controller CECC X M1 MV S1 (4407606)4 vulnerabilities
- Controller CECC X M1 MV S1 (8124924)4 vulnerabilities
- Controller CECC X M1 Y YJKP (4803891)4 vulnerabilities
- Controller CECC X M1 YS L1 (8082793)4 vulnerabilities
- Controller CECC X M1 YS L2 (8082794)4 vulnerabilities
- Servo Press Kit Yjkp4 vulnerabilities
- Servo Press Kit YJKP (8077950)4 vulnerabilities
- Servo Press Kit Yjkp4 vulnerabilities
- Servo Press Kit YJKP (8058596)4 vulnerabilities
- Cecx X C1 Modular Master Controller3 vulnerabilities
- Cecx X M1 Modular Controller3 vulnerabilities
- Controller Cecc D2 vulnerabilities
- Controller Cecc Lk2 vulnerabilities
- Controller Cecc S2 vulnerabilities
- Bus Module Cpx E Ep1 vulnerabilities
- Bus Node Cpx Fb321 vulnerabilities
- Bus Node Cpx Fb331 vulnerabilities
- Bus Node Cpx Fb361 vulnerabilities
- Bus Node Cpx Fb371 vulnerabilities
- Bus Node Cpx Fb391 vulnerabilities
- Bus Node Cpx Fb401 vulnerabilities
- Bus Node Cpx Fb431 vulnerabilities
- Bus Node Cpx M Fb341 vulnerabilities
- Bus Node Cpx M Fb351 vulnerabilities
- Bus Node Cpx M Fb441 vulnerabilities
- Bus Node Cpx M Fb451 vulnerabilities
- Bus Node Cteu Ep1 vulnerabilities
- Bus Node Cteu Pn1 vulnerabilities
- Bus Node Cteu Pn Ex1C1 vulnerabilities
- Camera System Chb C N1 vulnerabilities
- Compact Vision System Sboc C1 vulnerabilities
- Compact Vision System Sboc M1 vulnerabilities
- Compact Vision System Sboc Q1 vulnerabilities
- Compact Vision System Sboi C1 vulnerabilities
- Compact Vision System Sboi M1 vulnerabilities
- Compact Vision System Sboi Q1 vulnerabilities
- Control Block Cpx Cec1 vulnerabilities
- Control Block Cpx Cec C11 vulnerabilities
CVE-2020-12069codesyscodesys v3 containing the cmpusermgr+64
EPSS score0.17%
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.CVE-2014-07603s-softwarecodesys_runtime_system+5EPSS score3.35%
The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1
Modular Controller with CoDeSys and SoftMotion provide an undocumented
access method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a denial of service (application
crash) via unspecified vectors.CVE-2014-07693s-softwarecodesys_runtime_system+5EPSS score2.32%
The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001.CVE-2022-30309festocontroller_cecc-x-m1_firmware+18EPSS score2.92%
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.CVE-2022-30310festocontroller_cecc-x-m1_firmware+18EPSS score2.69%
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.CVE-2022-30308festocontroller_cecc-x-m1_firmware+18EPSS score2.92%
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.CVE-2022-30311festocontroller_cecc-x-m1_firmware+18EPSS score2.69%
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.CVE-2022-3270festo sebus module cpx-e-ep+153EPSS score1.09%
In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidentiality, integrity and availability.CVE-2022-3079festocontrol block cpx-cec-c1 (no. 567347)+3EPSS score0.78%
Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.CVE-2012-60693s-smart software solutionscodesys control rte+5EPSS score2.64%
The CoDeSys Runtime Toolkit’s file transfer functionality does not
perform input validation, which allows an attacker to access files and
directories outside the intended scope. This may allow an attacker to
upload and download any file on the device. This could allow the
attacker to affect the availability, integrity, and confidentiality of
the device.CVE-2012-60683s-smart software solutionscodesys control rte+5EPSS score5.27%
The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service.CVE-2023-3634festomse6-c2m-5000-fb36-d-m-rg-bar-m12l4-agd+11EPSS score0.64%
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.