Skip to content
OpenAdvisories
Critical FSA-202208 2 CVEs

Festo: Multiple Festo products contain an unsafe default Codesys configuration

Published Nov 29, 2022 · Updated Oct 28, 2025 · Revision 3

Vendor: Festo Product: Compact Vision System SBO*-Q-* Product: Control block CPX-CEC Codesys V2 Product: Control block CPX-CEC-C1 Codesys V2 Product: Control block CPX-CEC-C1-V3 Codesys V3 Product: Control block CPX-CEC-M1 Codesys V2 Product: Control block CPX-CEC-M1-V3 Codesys V3 Product: Control block CPX-CEC-S1-V3 Codesys V3 Product: Control block CPX-CMXX Product: Controller CECC-D Product: Controller CECC-D-BA Product: Controller CECC-D-CS Product: Controller CECC-LK Product: Controller CECC-S Product: Controller CECC-X-M1 Product: Controller CECC-X-M1-MV Product: Controller CECC-X-M1-S1 Product: Controller CECX-X-C1 Product: Controller CECX-X-M1 Product: Controller CPX-E-CEC-C1 Product: Controller CPX-E-CEC-C1-EP Product: Controller CPX-E-CEC-C1-PN Product: Controller CPX-E-CEC-M1 Product: Controller CPX-E-CEC-M1-EP Product: Controller CPX-E-CEC-M1-PN Product: Controller FED-CEC Product: Operator unit CDPX-X-A-S-10 Product: Operator unit CDPX-X-A-W-13 Product: Operator unit CDPX-X-A-W-4 Product: Operator unit CDPX-X-A-W-7 +3 more

Summary

The products are shipped with an unsafe configuration of the integrated CODESYS Runtime
environment. In this case no default password is set to the CODESYS PLC and therefore access
without authentication is possible.

With a successful established connection to the CODESYS Runtime the PLC-Browser commands are
available. Thus granting the possibilities to e.g. read and modify the configuration file(s), start/stop
the application and reboot the device.

Details

Festo has identified the following compensatory measures to reduce the risk:

- For CVE-2022-22515: Using the online user management prevents an attacker from
downloading and execute malicious code, but also suppresses start, stop, debug, or other
actions on a known working application that could potentially disrupt a machine or system.
- For CVE-2022-31806: Enable password protection at login in case no password is set at the controller. Please note that the password configuration file is not covered via default FFT backup & Restore mechanism, you must select the related file manually.

Vulnerabilities 2

Revision history

  1. #1.0.2

    Adjusted to VDE template. Changed title from "Multiple Festo products contain an unsafe default Codesys configuration" to "Festo: Multiple Festo products contain an unsafe default Codesys configuration". Updated legal disclaimer to add references to special provisions.

  2. #1.0.1

    Adjust link to VDE Advisory

  3. #1.0.0

    Initial revision.

References