Share: Email | Twitter

ID

VDE-2023-020

Published

2023-09-05 12:00 (CEST)

Last update

2023-09-01 08:42 (CEST)

Vendor(s)

Festo SE & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
8169406 MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L4-AGD all versions
8157913 MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L5-AGD all versions
8169407 MSE6-C2M-5000-FB43-D-M-RG-BAR-M12L4-MQ1-AGD all versions
8157912 MSE6-C2M-5000-FB43-D-M-RG-BAR-M12L5-MQ1-AGD all versions
8157908 MSE6-C2M-5000-FB44-D-M-RG-BAR-AMI-AGD all versions
8157909 MSE6-C2M-5000-FB44-D-RG-BAR-AMI-AGD all versions
8085453 MSE6-D2M-5000-CBUS-S-RG-BAR- VCB-AGD all versions
2465321 MSE6-E2M-5000-FB13-AGD all versions
3990296 MSE6-E2M-5000-FB36-AGD all versions
3992150 MSE6-E2M-5000-FB37-AGD all versions
8157910 MSE6-E2M-5000-FB43-AGD all versions
8157911 MSE6-E2M-5000-FB44-AGD all versions

Summary

Incomplete user documentation of undocumented, authenticated test mode and further remote accessible functions. The supported features may be covered only partly by the corresponding user documentation.

Festo developed the products according to the respective state of the art. As a result, the protocols used no longer fully meet today's security requirements. The products are designed and developed for use in sealed-off (industrial) networks. If the network is not adequately sealed off, unauthorized access to the product can cause damage or malfunctions, particularly Denial of Service (DoS) or loss of integrity.

CVE ID

CVE-2023-3634 

Last Update:

Aug. 30, 2023, 8:15 a.m.

Severity

8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) 

Weakness

Hidden Functionality  (CWE-912) 

Summary

In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.

Details

cert.vde.com 

Impact

In products of the MSE6 product-family by Festo a remote authenticated attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.

Solution

Remediation

Update of user documentation in next product version.

General recommendations

Users running communication over an untrusted network who require full protection should switch to an alternative solution such as running the communication over a VPN.

Festo strongly recommends to minimize and protect network access to connected devices with state of the art techniques and processes.

As part of a security strategy, Festo recommends the following general defense measures to reduce the risk of exploits:

  • Use devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside
  • Use firewalls to protect and separate the control system network from other networks - Use VPN (Virtual Private Networks) tunnels if remote access is required
  • Activate and apply user management and password features
  • Use encrypted communication links
  • Limit the access to both development and control system by physical means, operating system features, etc.
  • Protect both development and control system by using up to date virus detecting solutions

Reported by

CERT@VDE coordinated with Festo