Skip to content
OpenAdvisories
Critical ICSA-25-182-02 1 CVE

FESTO Automation Suite, FluidDraw, and Festo Didactic Products

Published Nov 28, 2023 · Updated Dec 5, 2023 · Revision 2

Vendor: Festo Vendor: FESTO Didactic Product: Automation Suite Product: CIROS Studio / Education Product: FluidDraw Product: FluidSIM Product: MES-PC

Summary

A vulnerability in the Wibu CodeMeter Runtime, which is part of the installation packages of several Festo products, was found. An attacker exploiting the vulnerability in WIBU CodeMeter Runtime in server mode could gain full access to the affected server via network access without any user interaction. This could lead to remote code execution and escalation of privileges giving full admin access on the host system for an already authenticated user (logged in locally to the PC).

Vulnerabilities 1

  • Critical 9.8
    CVE-2023-3935

    Wibu: Buffer Overflow in CodeMeter Runtime

    A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.

    Wibu codemeter-runtime

Revision history

  1. #1.1.0

    Removed 'MES4 (v3)', 'MES4 (<=v2)' and 'Energy-PC' from affected products as they do not install WIBU CodeMeter Runtime.

  2. #1.0.0

    Initial version

References