Multiple OpenSSL vulnerabilities affect Festo AX OS in CEPE
Festo AX OS versions 25.0.1.46 and 25.9.2.4, which are based on PLCnext by Phoenix Contact, used by the Festo product CEPE are affected by multiple OpenSSL vulnerabilities. The vulnerabilities are identified as CVE-2025-15467 and CVE-2025-69419. Attacks may be possible when maliciously crafted firmware, key files, PKCS#12 files, CMS/PKCS#7 content, or digitally signed objects are uploaded and processed by the affected system. In the device context, exploitation typically requires a logged-in user with high privileges or the processing of attacker-supplied cryptographic objects.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-69419US | — | Exploit | ||
Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously
crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing
non-ASCII BMP code point can tr… | ||||
| CVE-2025-15467US | — | Exploit | ||
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with
maliciously crafted AEAD parameters can trigger a stack buffer overflow.
Impact summary: A stack buffer… | ||||
references
External citations — patches, advisories, analysis.
- FSA-202602: Multiple OpenSSL vulnerabilities affect Festo AX OS in CEPE - HTMLself
- CERT@VDE Advisoryexternal
- FSA-202602: Multiple OpenSSL vulnerabilities affect Festo AX OS in CEPE - CSAFself
- Phoenix Contact Advisory PCSA-2026-00001 / VDE-2026-023: Several products are affected by vulnerabilities found in OpenSSLexternal
- For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)external
remediations (4)
- FixedFesto AX OS 25.0.1.46 installed on CEPE Product
Update affected CEPE installations running Festo AX OS 25.0.1.46 or Festo AX OS 25.9.2.4 to Festo AX OS 26.3.1.4 or later.
- FixedFesto AX OS 25.0.1.46 installed on CEPE Product
Update affected CEPE installations running Festo AX OS 25.0.1.46 or Festo AX OS 25.9.2.4 to Festo AX OS 26.3.1.4 or later.
- FixedFesto AX OS 25.9.2.4 installed on CEPE Product
Update affected CEPE installations running Festo AX OS 25.0.1.46 or Festo AX OS 25.9.2.4 to Festo AX OS 26.3.1.4 or later.
- FixedFesto AX OS 25.9.2.4 installed on CEPE Product
Update affected CEPE installations running Festo AX OS 25.0.1.46 or Festo AX OS 25.9.2.4 to Festo AX OS 26.3.1.4 or later.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan