The Festo controller CECC product family is affected by multiple vulnerabilities in the CODESYS V3 runtime.
The Festo controller CECC product family in firmware version 2.4.2.0 is affected by multiple vulnerabilities in the CODESYS V3 runtime.
The machine controller of the cabinet series include an OPC-UA server which uses an user management to authenticate clients via anonymous or user/password authentication. If the user/password authentication is selected, password verification is skipped upon second login. As a result, cases occur in which users can establish communication without correct authentication. This vulnerability is not located in the OPC-UA protocol or server, but in the interface to the products firmware.
This Security Advisory is only relevant for the following use cases:
• the user management has been activated on the machine controller (is deactivated by default)
• the OPC-UA Server is used
• Data are transferred via a symbol configuration (is not available by default)
The Festo controller CECC-X-M1 product family in multiple versions are affected by a preauthentication command injection vulnerability.
Update A, 2022-07-05
Remediation has been updated. Fixed firmwares are now available.