CISA + vendors

ICS Advisories

Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.

Found

Advisory data: live connection— last retrieved: 7 November 2026 at 02:05.

Filters

1 active

Reset filters

Search: FSA-202207

Vendor

Protocol

Sector

Severity

Source

1 advisories found

FSA-202207

Festo: CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function

Festo — Control block CPX-CEC-C1

Festo PSIRThigh

Published

20 September 2022

Last update

28 July 2025

Linked CVEs

CVE-2022-3079

Affected sectors

Risk evaluation

Unauthenticated access to critical webpage functions (e.g. reboot) may cause a denial of service of the device.

Mitigation summary

Currently no fix is planned. Festo recommends limiting access to the webserver (tcp port 80) of the device to what is absolutely necessary. Replace CPX-CEC-C1 with follow-up product CPX-CEC-C1-V3. Replace CPX-CMXX with follow up product CPX-CEC-M1-V3.

Revision history (4)

Initial publication — 20 September 2022
Initial revision.
Update A — 19 October 2022
Added Control block-Set CPX-CEC-C1 and Control block-SET CPX-CMXX to affected products.
Update B — 11 January 2024
Adjust link to VDE Advisory
Update C — 28 July 2025
Adjusted to VDE template. Change title from 'CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function' to 'Festo: CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function'. Updated legal disclaimer to add references to special provisions. Remediations were consolidated into one.

Official source: Festo PSIRT