FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

9.8 CVSS

Vulnerability Description

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-30309

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Q. Kaiser, M. Illes from ONEKEY Research Labs for reported to Festo

References

https://cert.vde.com/en/advisories/VDE-2022-020/

More from Festo

View All →

CVE-2023-3634

Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions

High 8.8

CVE-2022-30311

FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

Critical 9.8

CVE-2022-30310

FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

Critical 9.8

CVE-2022-30308

FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

Critical 9.8

CVE-2014-0769

Festo CECX-X-(C1/M1) Controller Improper Authentication

Critical 9.3

Affected Vendor

Festo

View all reports →

Affected Software

Controller CECC-X-M1 (4407603), Controller CECC-X-M1 (8124922), Controller CECC-X-M1-MV (4407605), Controller CECC-X-M1-MV (8124923), Controller CECC-X-M1-MV-S1 (4407606), Controller CECC-X-M1-MV-S1 (8124924), Controller CECC-X-M1-YS-L1 (8082793), Controller CECC-X-M1-YS-L2 (8082794), Controller CECC-X-M1-Y-YJKP (4803891), Servo Press Kit YJKP (8077950), Servo Press Kit YJKP- (8058596)

Vulnerable Versions:

3.0.0, 4.0.14