The machine controller of the cabinet series include an OPC-UA server which uses an user management to authenticate clients via anonymous or user/password authentication. If the user/password authentication is selected, password verification is skipped upon second login. As a result, cases occur in which users can establish communication without correct authentication. This vulnerability is not located in the OPC-UA protocol or server, but in the interface to the products firmware.

This Security Advisory is only relevant for the following use cases:

• the user management has been activated on the machine controller (is deactivated by default)

• the OPC-UA Server is used

• Data are transferred via a symbol configuration (is not available by default)



The Festo controller CECC-X-M1 product family in multiple versions are affected by a preauthentication command injection vulnerability.

Update A, 2022-07-05

Remediation has been updated. Fixed firmwares are now available.



Feeds

By Vendor

Archive

2024
2023
2022
2021
2020
2019
2018
2017

Legend

(Scoring for CVSS 2.0,3.0+3.1)
None
No CVE available
Low
0.1 <= 3.9
Medium
4.0 <= 6.9
High
7.0 <= 8.9
Critical
9.0 <= 10.0