Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2022-30309

FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Festo Controller CECC-X-M1 (4407603)

Default version status: unaffected

  • 3.0.0 to ≤ 3.8.14affected

Festo Controller CECC-X-M1 (8124922)

Default version status: unaffected

  • 4.0.14affected

Festo Controller CECC-X-M1-MV (4407605)

Default version status: unaffected

  • 3.0.0 to ≤ 3.8.14affected

Festo Controller CECC-X-M1-MV (8124923)

Default version status: unaffected

  • 4.0.14affected

Festo Controller CECC-X-M1-MV-S1 (4407606)

Default version status: unaffected

  • 3.0.0 to ≤ 3.8.14affected

Festo Controller CECC-X-M1-MV-S1 (8124924)

Default version status: unaffected

  • 4.0.14affected

Festo Controller CECC-X-M1-YS-L1 (8082793)

Default version status: unaffected

  • 3.0.0 to ≤ 3.8.14affected

Festo Controller CECC-X-M1-YS-L2 (8082794)

Default version status: unaffected

  • 3.0.0 to ≤ 3.8.14affected

Festo Controller CECC-X-M1-Y-YJKP (4803891)

Default version status: unaffected

  • 3.0.0 to ≤ 3.8.14affected

Festo Servo Press Kit YJKP (8077950)

Default version status: unaffected

  • 3.0.0 to ≤ 3.8.14affected

Festo Servo Press Kit YJKP- (8058596)

Default version status: unaffected

  • 3.0.0 to ≤ 3.8.14affected

References