CVE-2022-30309

FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

State: Published
Severity: 9.8 Critical
Published: Jun 13, 2022
Updated: Sep 16, 2024
Reserved: May 6, 2022

Description

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-863 Incorrect Authorization
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Controller CECC-X-M1 (4407603)Festo	3.0.0 through 3.8.14Affected
Controller CECC-X-M1 (8124922)Festo	4.0.14Affected
Controller CECC-X-M1-MV (4407605)Festo	3.0.0 through 3.8.14Affected
Controller CECC-X-M1-MV (8124923)Festo	4.0.14Affected
Controller CECC-X-M1-MV-S1 (4407606)Festo	3.0.0 through 3.8.14Affected
Controller CECC-X-M1-MV-S1 (8124924)Festo	4.0.14Affected
Controller CECC-X-M1-YS-L1 (8082793)Festo	3.0.0 through 3.8.14Affected
Controller CECC-X-M1-YS-L2 (8082794)Festo	3.0.0 through 3.8.14Affected
Controller CECC-X-M1-Y-YJKP (4803891)Festo	3.0.0 through 3.8.14Affected
Servo Press Kit YJKP (8077950)Festo	3.0.0 through 3.8.14Affected
Servo Press Kit YJKP- (8058596)Festo	3.0.0 through 3.8.14Affected

References

https://cert.vde.com/en/advisories/VDE-2022-020/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.