Summary
Incomplete Festo product documentation of remote accessible functions and their required IP ports. Depending on the product a description of the supported features can be found in the product documentation to some extent.
Update A, 2022-12-13
Added affected device "Bus module CPX-E-PN, 4080497"
Details
Impact
Please consult the CVE details above.
Mitigation
Update of technical user manual documentation in next product version.
Vulnerabilities 1
-
Critical 9.8
Incomplete Documentation of remote functions in FESTO products.
In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidentiality, integrity and availability.
Revision history
-
#1.2.1
Adjust link to VDE Advisory. Change title from "Incomplete User Documentation of Remote Accessible Functions and Protocols in Festo Products" to "Festo: Incomplete documentation of remote accessible functions and protocols in Festo products". Updated legal disclaimer to add references to special provisions.
-
#1.2.0
adjusted technical user documentation to user documentation and fixed some typos.
-
#1.1.0
added bus module CPX-E-PN as affected product
-
#1.0.0
Initial revision.
References
-
FSA-202209: Festo: Incomplete documentation of remote accessible functions and protocols in Festo products - HTML
https://certvde.com/en/advisories/VDE-2022-041/
-
For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)
https://festo.com/psirt
-
CERT@VDE Security Advisories for Festo SE & Co. KG
https://certvde.com/en/advisories/vendor/festo/