Most recent entries from csaf_festosecokg

FSA-202406 — Several Codesys Gateway v2 vulnerabilities in Codesys provided by Festo

Tue, 03 Dec 2024 11:00:00 +0000

An unauthenticated attacker would be able to send crafted requests to cause the CODESYS Gateway Server V2 to allocate excessive memory or consume all available TCP client connections. Besides, passwords are insufficiently checked during login.

All versions of the following CODESYS V2 product prior version V2.3.9.38 are affected:

• CODESYS Gateway Server

FSA-202305 — Festo: Vulnerable WIBU-SYSTEMS CodeMeter Runtime in several products

Tue, 28 Nov 2023 07:00:00 +0000

A vulnerability in the Wibu CodeMeter Runtime, which is part of the installation packages of several Festo products, was found. An attacker exploiting the vulnerability in WIBU CodeMeter Runtime in server mode could gain full access to the affected server via network access without any user interaction. This could lead to remote code execution and escalation of privileges giving full admin access on the host system for an already authenticated user (logged in locally to the PC).

FSA-202201 — Festo: CECC-X-M1 - command injection vulnerabilities

Wed, 06 Jul 2022 07:00:00 +0000

The Festo controller CECC-X-M1 product family in multiple versions are affected by a preauthentication command injection vulnerability. Update A, 2022-07-05 Remediation has been updated. Fixed firmwares are now available.

FSA-202203 — Festo: Controller CECC-S,LK,D family firmware 2.4.2.0 - multiple vulnerabilities in CODESYS V3 runtime system

Mon, 18 Jul 2022 10:00:00 +0000

The Festo controller CECC product family in firmware version 2.4.2.0 is affected by multiple vulnerabilities in the CODESYS V3 runtime.

FSA-202207 — Festo: CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function

Tue, 20 Sep 2022 10:00:00 +0000

Unauthenticated access to critical webpage functions (e.g. reboot) may cause a denial of service of the device.

FSA-202101 — Festo: Multiple vulnerabilities in Ethernet/IP Stack of SBRD-Q/SBOC-Q/SBOI-Q

Wed, 22 Sep 2021 11:13:00 +0000

The affected product families are cameras SBOC/SBOI and the Controller SBRD. The vulnerabilities are located within the Ethernet IP Stack from EIPStackGroup OpENer Ethernet/IP.

FSA-202303 — Festo: Vulnerable Siemens TIA-Portal in multiple Festo Didactic products

Tue, 17 Oct 2023 06:00:00 +0000

A vulnerability was reported in Siemens TIA Portal. TIA Portal is part of the installation packages of several Festo Didactic products.

TP 260 before June 2023 and MES PC based on DELL XE3 contain a vulnerable versions of TIA Portal V15 to V18.

Affected products of TIA Portal contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system.

FSA-202301 — Festo: Cross-Site-Scripting (XSS) vulnerability in LX-Appliance

Tue, 29 Aug 2023 10:00:00 +0000

A vulnerability in the Video.js package could allow a user of LX Appliance, with a high privilege account (i.e., with the "Teacher" role), to craft a malicious course and launch an XSS attack.

FSA-202304 — Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions

Tue, 05 Sep 2023 10:00:00 +0000

Incomplete user documentation of undocumented, authenticated test mode and further remote accessible functions. The supported features may be covered only partly by the corresponding user documentation.

Festo developed the products according to the respective state of the art. As a result, the protocols used no longer fully meet today's security requirements. The products are designed and developed for use in sealed-off (industrial) networks. If the network is not adequately sealed off, unauthorized access to the product can cause damage or malfunctions, particularly Denial of Service (DoS) or loss of integrity.

FSA-202206 — Festo: Vulnerable WIBU-SYSTEMS CodeMeter Runtime in multiple products

Tue, 13 Dec 2022 11:50:00 +0000

A vulnerability was reported in WIBU-SYSTEMS CodeMeter Runtime. WIBU-SYSTEMS CodeMeter Runtime is part of the installation packages of several Festo products.FluidDraw < 6.2c and CIROS <= 7.0.6 contain a vulnerable version of WIBU-SYSTEMS CodeMeter Runtime.