Multiple OpenSSL vulnerabilities affect Festo AX OS in CEPE
Festo AX OS versions 25.0.1.46 and 25.9.2.4, which are based on PLCnext by Phoenix Contact, used by the Festo product CEPE are affected by multiple OpenSSL vulnerabilities. The vulnerabilities are identified as CVE-2025-15467 and CVE-2025-69419. Attacks may be possible when maliciously crafted firmware, key files, PKCS#12 files, CMS/PKCS#7 content, or digitally signed objects are uploaded and processed by the affected system. In the device context, exploitation typically requires a logged-in user with high privileges or the processing of attacker-supplied cryptographic objects.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-69419US | — | Exploit | ||
Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously
crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing
non-ASCII BMP code point can tr… | ||||
| CVE-2025-15467US | — | Exploit | ||
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with
maliciously crafted AEAD parameters can trigger a stack buffer overflow.
Impact summary: A stack buffer… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- FSA-202602: Multiple OpenSSL vulnerabilities affect Festo AX OS in CEPE - HTMLself
- CERT@VDE Advisoryexternal
- FSA-202602: Multiple OpenSSL vulnerabilities affect Festo AX OS in CEPE - CSAFself
- Phoenix Contact Advisory PCSA-2026-00001 / VDE-2026-023: Several products are affected by vulnerabilities found in OpenSSLexternal
- For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)external
Behebungen (4)
- BehobenFesto AX OS 25.0.1.46 installed on CEPE Product
Update affected CEPE installations running Festo AX OS 25.0.1.46 or Festo AX OS 25.9.2.4 to Festo AX OS 26.3.1.4 or later.
- BehobenFesto AX OS 25.0.1.46 installed on CEPE Product
Update affected CEPE installations running Festo AX OS 25.0.1.46 or Festo AX OS 25.9.2.4 to Festo AX OS 26.3.1.4 or later.
- BehobenFesto AX OS 25.9.2.4 installed on CEPE Product
Update affected CEPE installations running Festo AX OS 25.0.1.46 or Festo AX OS 25.9.2.4 to Festo AX OS 26.3.1.4 or later.
- BehobenFesto AX OS 25.9.2.4 installed on CEPE Product
Update affected CEPE installations running Festo AX OS 25.0.1.46 or Festo AX OS 25.9.2.4 to Festo AX OS 26.3.1.4 or later.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan