Festo: CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function
view advisory published 2022-09-20
Unauthenticated access to critical webpage functions (e.g. reboot) may cause a denial of service of the device.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-3079US | — | — | ||
Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service. | ||||
02
references
External citations — patches, advisories, analysis.
- FSA-202207: Festo: CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function - HTMLself
- CERT@VDE Security Advisoriesexternal
- CVE Entry at mitreexternal
- For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)external
- FSA-202207: Festo: CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function - CSAFself
03
remediations (1)
- No fix planned
Currently no fix is planned. Festo recommends limiting access to the webserver (tcp port 80) of the device to what is absolutely necessary. Replace CPX-CEC-C1 with follow-up product CPX-CEC-C1-V3. Replace CPX-CMXX with follow up product CPX-CEC-M1-V3.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan