Skip to content
OpenAdvisories
High FSA-202304 1 CVE

Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions

Published Sep 5, 2023 · Updated Oct 1, 2025 · Revision 2

Vendor: Festo Product: MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L4-AGD Product: MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L5-AGD Product: MSE6-C2M-5000-FB43-D-M-RG-BAR-M12L4-MQ1-AGD Product: MSE6-C2M-5000-FB43-D-M-RG-BAR-M12L5-MQ1-AGD Product: MSE6-C2M-5000-FB44-D-M-RG-BAR-AMI-AGD Product: MSE6-C2M-5000-FB44-D-RG-BAR-AMI-AGD Product: MSE6-D2M-5000-CBUS-S-RG-BAR-VCB-AGD Product: MSE6-E2M-5000-FB13-AGD Product: MSE6-E2M-5000-FB36-AGD Product: MSE6-E2M-5000-FB37-AGD Product: MSE6-E2M-5000-FB43-AGD Product: MSE6-E2M-5000-FB44-AGD

Summary

Incomplete user documentation of undocumented, authenticated test mode and further remote accessible functions.
The supported features may be covered only partly by the corresponding user documentation.

Festo developed the products according to the respective state of the art. As a result, the protocols used no longer fully meet today's security requirements.
The products are designed and developed for use in sealed-off (industrial) networks.
If the network is not adequately sealed off, unauthorized access to the product can cause damage or malfunctions, particularly Denial of Service (DoS) or loss of integrity.

Details

Impact
In products of the MSE6 product-family by Festo a remote authenticated attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.

Remediation
Update of user documentation in next product version.

Vulnerabilities 1

Revision history

  1. #1.0.1

    Adjusted to VDE template. Changed title from "MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions" to "Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions".

  2. #1.0.0

    Initial revision.

References