Festo PSIRT
organizationDE01
references
Other names and identifiers for this entity.
festo_psirtDE psirt@festo.com
02
assessed vulnerabilities (332)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-3634US | — | — | ||
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of… | ||||
| CVE-2025-69419US | — | Exploit | ||
Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously
crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing
non-ASCII BMP code point can tr… | ||||
| CVE-2025-15467US | — | Exploit | ||
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with
maliciously crafted AEAD parameters can trigger a stack buffer overflow.
Impact summary: A stack buffer… | ||||
| CVE-2025-41659US | — | — | ||
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to… | ||||
| CVE-2025-41658US | —OT elevated | — | ||
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions. | ||||
| CVE-2025-2595US | — | — | ||
An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing. | ||||
| CVE-2025-1468US | — | — | ||
An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-default Basic128Rsa15… | ||||
| CVE-2025-0694US | — | — | ||
Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access. | ||||
| CVE-2024-8175US | — | — | ||
An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS. | ||||
| CVE-2024-5000US | — | — | ||
An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of bu… | ||||
| CVE-2023-49676US | — | — | ||
An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability. | ||||
| CVE-2023-49675US | — | — | ||
An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vulnerability.
| ||||
| CVE-2023-6357US | — | — | ||
A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the d… | ||||
| CVE-2022-4900US | medium5.5 | — | ||
A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow. | ||||
| CVE-2023-3935US | — | — | ||
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of… | ||||
| CVE-2022-4046US | — | — | ||
In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access… | ||||
| CVE-2023-3669US | —OT elevated | — | ||
A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialo… | ||||
| CVE-2023-37559US | — | — | ||
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the… | ||||
| CVE-2023-37558US | — | — | ||
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the… | ||||
| CVE-2023-37557US | — | — | ||
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to over… | ||||