Skip to content
OpenAdvisories
Critical FSA-202602 2 CVEs

Multiple OpenSSL vulnerabilities affect Festo AX OS in CEPE

Published Oct 20, 2026 · Updated Oct 20, 2026

Vendor: Festo Product: AX OS Product: CEPE

Summary

Festo AX OS versions 25.0.1.46 and 25.9.2.4, which are based on PLCnext by Phoenix Contact, used by the Festo product CEPE are affected by multiple OpenSSL vulnerabilities. The vulnerabilities are identified as CVE-2025-15467 and CVE-2025-69419. Attacks may be possible when maliciously crafted firmware, key files, PKCS#12 files, CMS/PKCS#7 content, or digitally signed objects are uploaded and processed by the affected system. In the device context, exploitation typically requires a logged-in user with high privileges or the processing of attacker-supplied cryptographic objects.

Details

Festo recommends updating affected CEPE installations running Festo AX OS 25.0.1.46 or Festo AX OS 25.9.2.4 to Festo AX OS 26.3.1.4 or later as soon as the fixed version becomes available.

Vulnerabilities 2

  • High 8.8
    CVE-2025-15467 Public exploit EPSS 75%

    Stack buffer overflow in CMS (Auth)EnvelopedData parsing

    Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine
  • High 7.4
    CVE-2025-69419 Public exploit

    Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

    Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine

Revision history

  1. #1.0.0

    Initial Revision

References