Festo: CECC-X-M1 - command injection vulnerabilities
The Festo controller CECC-X-M1 product family in multiple versions are affected by a preauthentication command injection vulnerability. Update A, 2022-07-05 Remediation has been updated. Fixed firmwares are now available.
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-30311US | high10.0OT elevated | — | ||
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This can result in unautho… | ||||
| CVE-2022-30310US | high10.0OT elevated | — | ||
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unautho… | ||||
| CVE-2022-30309US | high10.0OT elevated | — | ||
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in… | ||||
| CVE-2022-30308US | critical9.8OT elevated | — | ||
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in u… | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- Fixed
Please update to firmware versions as described below: | Product | Product Details | Fixed in version | |-----------------------------|-----------------------------------------------------------|------------------| | Controller CECC-X-M1 | Festo:Partnumber:4407603 Festo:Ordercode:CECC-X-M1 | 3.8.18 | | Controller CECC-X-M1 | Festo:Partnumber:8124922 Festo:Ordercode:CECC-X-M1 | 4.0.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:4407605 Festo:Ordercode:CECC-X-M1-MV | 3.8.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:8124923 Festo:Ordercode:CECC-X-M1-MV | 4.0.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:4407606 Festo:Ordercode:CECC-X-M1-MV-S1 | 3.8.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:8124924 Festo:Ordercode:CECC-X-M1-MV-S1 | 4.0.18 | | Controller CECC-X-M1-YYJKP | Festo:Partnumber:4803891 Festo:Ordercode:CECC-X-M1-YYJKP | 3.8.18 | | Controller CECC-X-M1-YSL1 | Festo:Partnumber:8082793 Festo:Ordercode:CECC-X-M1-YS-L1 | 3.8.18 | | Controller CECC-X-M1-YSL2 | Festo:Partnumber:8082794 Festo:Ordercode:CECC-X-M1-YS-L2 | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8077950 Festo:Ordercode:YJKP | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8058596 Festo:Ordercode:YJKP | 3.8.18 |
- Fixed
Please update to firmware versions as described below: | Product | Product Details | Fixed in version | |-----------------------------|-----------------------------------------------------------|------------------| | Controller CECC-X-M1 | Festo:Partnumber:4407603 Festo:Ordercode:CECC-X-M1 | 3.8.18 | | Controller CECC-X-M1 | Festo:Partnumber:8124922 Festo:Ordercode:CECC-X-M1 | 4.0.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:4407605 Festo:Ordercode:CECC-X-M1-MV | 3.8.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:8124923 Festo:Ordercode:CECC-X-M1-MV | 4.0.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:4407606 Festo:Ordercode:CECC-X-M1-MV-S1 | 3.8.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:8124924 Festo:Ordercode:CECC-X-M1-MV-S1 | 4.0.18 | | Controller CECC-X-M1-YYJKP | Festo:Partnumber:4803891 Festo:Ordercode:CECC-X-M1-YYJKP | 3.8.18 | | Controller CECC-X-M1-YSL1 | Festo:Partnumber:8082793 Festo:Ordercode:CECC-X-M1-YS-L1 | 3.8.18 | | Controller CECC-X-M1-YSL2 | Festo:Partnumber:8082794 Festo:Ordercode:CECC-X-M1-YS-L2 | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8077950 Festo:Ordercode:YJKP | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8058596 Festo:Ordercode:YJKP | 3.8.18 |
- Fixed
Please update to firmware versions as described below: | Product | Product Details | Fixed in version | |-----------------------------|-----------------------------------------------------------|------------------| | Controller CECC-X-M1 | Festo:Partnumber:4407603 Festo:Ordercode:CECC-X-M1 | 3.8.18 | | Controller CECC-X-M1 | Festo:Partnumber:8124922 Festo:Ordercode:CECC-X-M1 | 4.0.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:4407605 Festo:Ordercode:CECC-X-M1-MV | 3.8.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:8124923 Festo:Ordercode:CECC-X-M1-MV | 4.0.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:4407606 Festo:Ordercode:CECC-X-M1-MV-S1 | 3.8.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:8124924 Festo:Ordercode:CECC-X-M1-MV-S1 | 4.0.18 | | Controller CECC-X-M1-YYJKP | Festo:Partnumber:4803891 Festo:Ordercode:CECC-X-M1-YYJKP | 3.8.18 | | Controller CECC-X-M1-YSL1 | Festo:Partnumber:8082793 Festo:Ordercode:CECC-X-M1-YS-L1 | 3.8.18 | | Controller CECC-X-M1-YSL2 | Festo:Partnumber:8082794 Festo:Ordercode:CECC-X-M1-YS-L2 | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8077950 Festo:Ordercode:YJKP | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8058596 Festo:Ordercode:YJKP | 3.8.18 |
- Fixed
Please update to firmware versions as described below: | Product | Product Details | Fixed in version | |-----------------------------|-----------------------------------------------------------|------------------| | Controller CECC-X-M1 | Festo:Partnumber:4407603 Festo:Ordercode:CECC-X-M1 | 3.8.18 | | Controller CECC-X-M1 | Festo:Partnumber:8124922 Festo:Ordercode:CECC-X-M1 | 4.0.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:4407605 Festo:Ordercode:CECC-X-M1-MV | 3.8.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:8124923 Festo:Ordercode:CECC-X-M1-MV | 4.0.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:4407606 Festo:Ordercode:CECC-X-M1-MV-S1 | 3.8.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:8124924 Festo:Ordercode:CECC-X-M1-MV-S1 | 4.0.18 | | Controller CECC-X-M1-YYJKP | Festo:Partnumber:4803891 Festo:Ordercode:CECC-X-M1-YYJKP | 3.8.18 | | Controller CECC-X-M1-YSL1 | Festo:Partnumber:8082793 Festo:Ordercode:CECC-X-M1-YS-L1 | 3.8.18 | | Controller CECC-X-M1-YSL2 | Festo:Partnumber:8082794 Festo:Ordercode:CECC-X-M1-YS-L2 | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8077950 Festo:Ordercode:YJKP | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8058596 Festo:Ordercode:YJKP | 3.8.18 |
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan