Skip to content
OpenAdvisories
Critical 3 exploited CVEs FSA-202302 173 CVEs

Festo: Several vulnerabilities in FactoryViews

Published Jul 10, 2023 · Updated Feb 2, 2026 · Revision 4

Vendor: Festo Product: FactoryViews Product: FactoryViews Lite

Summary

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

Details

Impact
The vulnerabilities covered by this advisory have a broad range of impacts ranging from denial-of-service to disclosure or manipulation/deletion of information.

Given the intended purpose of FactoryViews as a didactic tool in controlled lab environments,separate from productive systems, it never comes into contact with sensitive information. Thereforethe impact is reduced to limited availability of the system.

To further reduce the risk due to loss of information, users should make use of the built-in backupfeature to safeguard important configurations needed for lessons.

General recommendations
Festo Didactic offers products with security functions that aid the safe operation of plants, systems, machines and networks. In order to protect plants, systems, machines and networks from cyber threats, a comprehensive security concept must be implemented and continuously updated. Festo's products and services only constitute one part of such a concept.

The customer is responsible for preventing unauthorized access to their plants, systems, machines and networks. Systems, machines and components should only be connected to a company's network or the Internet if and as necessary, and only when the suitable security measures (e.g., firewalls and network segmentation, defense-in-depth) are in place. Failure to ensure adequate security measures when connecting the product to the network can result in vulnerabilities which allow unauthorized, remote access to the network – even beyond the product's boundaries. This access could be abused to incur a loss of data or manipulate or sabotage systems. Typical forms of attack include but are not limited to: Denial-of-Service (rendering the system temporarily non- functional), remote execution of malicious code, privilege escalation (executing malicious code with higher system privileges than expected), ransomware (encryption of data and demanding payment for decryption). In the context of industrial systems and machines this can also lead to unsafe states, posing a danger to people and equipment.

Furthermore, Festo's guidelines on suitable security measures should be observed. Festo products and solutions are constantly being developed further in order to make them more secure. Festo strongly recommends that customers install product updates as soon as they become available and always use the latest versions of its products. Any use of product versions that are no longer supported or any failure to install the latest updates may render the customer vulnerable to cyberattacks.

Remediation
FactoryViews (non-Lite): Upgrade to FactoryViews 1.6.0. See the upgrade guide for information on how to upgrade.
FactoryViews Lite: Upgrade to FactoryViews 1.7.0. See the upgrade guide for information on how to upgrade.

Vulnerabilities 173

Revision history

  1. #1.0.3

    Added missing CWE values

  2. #1.0.2

    Adjusted to VDE template. Changed title from "Several Vulnerabilities in FactoryViews <= 1.5.2" to "Festo: Several vulnerabilities in FactoryViews". Updated legal disclaimer to add references to special provisions. Included remediation for FactoryViews Lite

  3. #1.0.1

    Adjust link to VDE Advisory.

  4. #1.0.0

    Initial revision.

References