CVE-2022-3079

highpriority · track · 0EPSS 0.008 · 56 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.78% (56th) EPSS

CVSS 7.5 · high

Is it mine?

10 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

The vendor does not plan to fix this; mitigate or replace.

No fix plannedfesto_psirt
Currently no fix is planned. Festo recommends limiting access to the webserver (tcp port 80) of the device to what is absolutely necessary. Replace CPX-CEC-C1 with follow-up product CPX-CEC-C1-V3. Replace CPX-CMXX with follow up product CPX-CEC-M1-V3.
No fix plannedcisa_csaf_ot
Currently no fix is planned. Festo recommends limiting access to the webserver (tcp port 80) of the device to what is absolutely necessary. Replace CPX-CEC-C1 with follow-up product CPX-CEC-C1-V3. Replace CPX-CMXX with follow up product CPX-CEC-M1-V3.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · info@cert.vde.comexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Festo PSIRT DE

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-269USCWE-269USCWE-269USCWE-269US

affected products (10)

Products and version ranges known to be affected.

Firmware <=1.2.34 rev.404 installed on Control block CPX-CMXXall versionscisa_csaf_otUS
Firmware <=2.0.12 installed on Control block CPX-CEC-C1all versionscisa_csaf_otUS
Control block CPX-CEC-C1 (no. 567347)≤ 0.0.1 ≤2.0.12enisa_euvdEU
Control block CPX-CMXX (no. 555667)≤ 0.0.1 ≤1.2.34 rev.269404enisa_euvdEU
Firmware <=1.2.34 rev.404 installed on Control block CPX-CMXXall versionsfesto_psirtDE
Firmware <=2.0.12 installed on Control block CPX-CEC-C1all versionsfesto_psirtDE
Festo SE & Co. KG Control block CPX-CEC-C1≤ 2.0.12fstec_bduRU
Festo SE & Co. KG Control block CPX-CMXX≤ 1.2.34 rev.404fstec_bduRU
festo cpx-cec-c1 firmware≤ 1.2.34nvdUScpe:2.3:o:festo:cpx-cec-c1_firmware:*:*:*:*:*:*:*:*
festo cpx-cmxx firmware≤ 2.0.12nvdUScpe:2.3:o:festo:cpx-cmxx_firmware:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

FSA-202207Festo: CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function2022-09-20csaf · festo_psirtDE
Unauthenticated access to critical webpage functions (e.g. reboot) may cause a denial of service of the device.
ICSA-25-273-03Festo CPX-CEC-C1 and CPX-CMXX2022-09-20icsa · cisa_csaf_otUS
Unauthenticated access to critical webpage functions (e.g. reboot) may cause a denial of service of the device.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot festo_psirt nvd NVD CVE.org MITRE

published 2022-09-20modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan