CRITICAL🇵🇱 Wersja polska

CVE-2022-30309

CVSS 9.8v3.1pub. 2022-06-13upd. 2024-11-21

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Festo Controller Cecc X M1

    HW
    Festo
    all versions

  • Festo Controller Cecc X M1 Firmware

    OS
    Festo
    4.0.14≤ 3.8.14

  • Festo Controller Cecc X M1 Mv

    HW
    Festo
    all versions

  • Festo Controller Cecc X M1 Mv Firmware

    OS
    Festo
    4.0.14≤ 3.8.14

  • Festo Controller Cecc X M1 Mv S1

    HW
    Festo
    all versions

  • Festo Controller Cecc X M1 Mv S1 Firmware

    OS
    Festo
    4.0.14≤ 3.8.14

  • Festo Controller Cecc X M1 Ys L1

    HW
    Festo
    all versions

  • Festo Controller Cecc X M1 Ys L1 Firmware

    OS
    Festo
    ≤ 3.8.14

  • Festo Controller Cecc X M1 Ys L2

    HW
    Festo
    all versions

  • Festo Controller Cecc X M1 Ys L2 Firmware

    OS
    Festo
    ≤ 3.8.14

  • Festo Controller Cecc X M1 Y Yjkp

    HW
    Festo
    all versions

  • Festo Controller Cecc X M1 Y Yjkp Firmware

    OS
    Festo
    ≤ 3.8.14

  • Festo Servo Press Kit Yjkp

    HW
    Festo
    all versions

  • Festo Servo Press Kit Yjkp

    HW
    Festo
    all versions

  • Festo Servo Press Kit Yjkp Firmware

    OS
    Festo
    ≤ 3.8.14

  • Festo Servo Press Kit Yjkp Firmware

    OS
    Festo
    ≤ 3.8.14
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2022-3270CRITICAL9.8PL ✓same product

Festo CPX: nieudokumentowany protokół umożliwia pełne przejęcie urządzenia

CVE-2022-30308CRITICAL9.8PL ✓same product

Command Injection z uprawnieniami root w Festo Controller CECC-X-M1

CVE-2022-30310CRITICAL9.8PL ✓same product

Command injection z uprawnieniami root w Festo Controller CECC-X-M1

CVE-2022-30311CRITICAL9.8PL ✓same product

Command injection w Festo Controller CECC-X-M1 — RCE z uprawnieniami root

CVE-2020-12069HIGH7.8same vendor

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime ...