Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2023-3634

Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions

In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Festo
Products
Mse6-c2m-5000-fb36-d-m-rg-bar-m12l4-agd Mse6-c2m-5000-fb36-d-m-rg-bar-m12l4-agd Firmware Mse6-c2m-5000-fb36-d-m-rg-bar-m12l5-agd and 21 more
CVE-2014-0769

Festo CECX-X-(C1/M1) Controller Improper Authentication

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001.

CVSS 2.0 · 9.3 Critical EPSS 2.3% KEV · Not listed
Vendors
3s-software Festo Softmotion3d
Products
Codesys Runtime System Cecx-x-c1 Modular Master Controller Cecx-x-m1 Modular Controller and 1 more
CVE-2014-0760

Festo CECX-X-(C1/M1) Controller Improper Authentication

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 3.3% KEV · Not listed
Vendors
3s-software Festo Softmotion3d
Products
Codesys Runtime System Cecx-x-c1 Modular Master Controller Cecx-x-m1 Modular Controller and 1 more
CVE-2022-3079

Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function

Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Festo
Products
Cpx-cec-c1 Cpx-cec-c1 Firmware Cpx-cmxx and 1 more
CVE-2020-12069

CODESYS V3 prone to Inadequate Password Hashing

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Codesys Festo Pilz and 1 more
Products
Control For Beaglebone Control For Empc-a\/imx6 Control For Iot2000 and 111 more
CVE-2022-3270

Incomplete Documentation of remote functions in FESTO products.

In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidentiality, integrity and availability.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Festo
Products
Bus Module Cpx-e-ep Bus Module Cpx-e-ep Firmware Bus Node Cpx-fb32 and 195 more
CVE-2022-30311

FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Festo
Products
Controller Cecc-x-m1 Controller Cecc-x-m1-mv Controller Cecc-x-m1-mv-s1 and 13 more
CVE-2022-30310

FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Festo
Products
Controller Cecc-x-m1 Controller Cecc-x-m1-mv Controller Cecc-x-m1-mv-s1 and 13 more
CVE-2022-30309

FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Festo
Products
Controller Cecc-x-m1 Controller Cecc-x-m1-mv Controller Cecc-x-m1-mv-s1 and 13 more
CVE-2022-30308

FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Festo
Products
Controller Cecc-x-m1 Controller Cecc-x-m1-mv Controller Cecc-x-m1-mv-s1 and 13 more