ICS Advisories

Risk evaluation

Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with PHP. The bundled version of PHP is vulnerable to the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (commonly referred to as PHP2Shell). These vulnerabilities allow an attacker to remotely execute code on the FactoryViews or xampp host system.

Mitigatiesamenvatting

Install patch 1.12.2 through the "Versions" page of the FactoryViews control panel on version 1.12.0 or 1.12.1. Versions of FactoryViews prior to 1.12 must first be updated to 1.12 available for download here: https://www.festo.com/de/de/support-portal-specific?query=factoryviews&groupId=4&productName=factoryviews&documentId=659952

Risk evaluation

Festo AX OS versions 25.0.1.46 and 25.9.2.4, which are based on PLCnext by Phoenix Contact, used by the Festo product CEPE are affected by multiple OpenSSL vulnerabilities. The vulnerabilities are identified as CVE-2025-15467 and CVE-2025-69419. Attacks may be possible when maliciously crafted firmware, key files, PKCS#12 files, CMS/PKCS#7 content, or digitally signed objects are uploaded and processed by the affected system. In the device context, exploitation typically requires a logged-in user with high privileges or the processing of attacker-supplied cryptographic objects.

Mitigatiesamenvatting

Update affected CEPE installations running Festo AX OS 25.0.1.46 or Festo AX OS 25.9.2.4 to Festo AX OS 26.3.1.4 or later.

Risk evaluation

Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

Mitigatiesamenvatting

Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

Risk evaluation

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications. FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities. At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

Mitigatiesamenvatting

FactoryViews (non-Lite): Upgrade to FactoryViews 1.6.0. See the upgrade guide for information on how to upgrade. FactoryViews Lite: Upgrade to FactoryViews 1.7.0. See the upgrade guide for information on how to upgrade.

Risk evaluation

MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications. MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.

Mitigatiesamenvatting

Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.

Risk evaluation

Siemens SIMATIC S7-1200 and S7-1500 CPUs contained in various Festo Didactic products contain a memory protection bypass vulnerability that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks

Mitigatiesamenvatting

Update Siemens Simatic S7-1500 / ET200SP Firmware to V2.9.2 or higher

Risk evaluation

Several high severity vulnerabilities in CODESYS V3 affecting Festo products could lead to Remote Code Execution or Denial of Service.

Mitigatiesamenvatting

As part of a security strategy, Festo recommends the following general defense measures to reduce the risk of exploits: - Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside - Use firewalls to protect and separate the control system network from other networks - Use VPN (Virtual Private Networks) tunnels if remote access is required Activate and apply user management and password features - Use encrypted communication links - Limit the access to both development and control system by physical means, operating system features, etc. - Protect both development and control system by using up to date virus detecting solutions Festo strongly recommends to minimize and protect network access to connected devices with state of the art techniques and processes. For a secure operation follow the recommendations in the product manuals.

Risk evaluation

The Festo controller CECC product family is affected by multiple vulnerabilities in the CODESYS V3 runtime.

Mitigatiesamenvatting

For CVE-2019-5105, CVE-2019-9011, CVE-2019-9013, CVE-2020-10245, CVE-2020-12067, CVE-2020-12068, CVE-2020-12069, CVE-2020-15806, CVE-2021-29241, CVE-2021-29242, CVE-2021-33485, CVE-2021-36763, CVE-2021-36764, CVE-2022-22513, CVE-2022-22514, CVE-2022-22515, CVE-2022-22517, CVE-2022-22519: No fix planned. This issue will be handled with next hardware generation release.

Risk evaluation

Incomplete Festo product documentation of remote accessible functions and their required IP ports. Depending on the product a description of the supported features can be found in the product documentation to some extent. Update A, 2022-12-13 Added affected device "Bus module CPX-E-PN, 4080497"

Mitigatiesamenvatting

Update of technical user manual documentation in next product version.

Risk evaluation

The products are shipped with an unsafe configuration of the integrated CODESYS Runtime environment. In this case no default password is set to the CODESYS PLC and therefore access without authentication is possible. With a successful established connection to the CODESYS Runtime the PLC-Browser commands are available. Thus granting the possibilities to e.g. read and modify the configuration file(s), start/stop the application and reboot the device.

Mitigatiesamenvatting

Festo has identified the following compensatory measures to reduce the risk: - For CVE-2022-22515: Using the online user management prevents an attacker from downloading and execute malicious code, but also suppresses start, stop, debug, or other actions on a known working application that could potentially disrupt a machine or system.

Risk evaluation

A vulnerability was reported in WIBU-SYSTEMS CodeMeter Runtime. WIBU-SYSTEMS CodeMeter Runtime is part of the installation packages of several Festo products.FluidDraw < 6.2c and CIROS <= 7.0.6 contain a vulnerable version of WIBU-SYSTEMS CodeMeter Runtime.

Mitigatiesamenvatting

FluidDraw P5, FluidDraw P6 Avoid any FluidDraw installation with a FluidDraw installation package below version 6.2c. Updated versions of FluidDraw are available on the Festo website. In case of a FluidDraw installation package with a version below 6.2c, do not use the WIBU CodeMeter package, that is part of the FluidDraw installation package. Skip the CodeMeter installation step during the FluidDraw installation and instead use a current CodeMeter version from the WIBU website and install that separately. In case of an already installed vulnerable CodeMeter version, update all of these WIBU CodeMeter installations with the current version of WIBU CodeMeter. Please refer to the WIBU CodeMeter documentation and website for further details and mitigations on usage of WIBU CodeMeter Runtime before 7.30a. CIROS For future installations, ensure you're using a CIROS installer downloaded from https://ip.festo-didactic.com/ Infoportal/CIROS/EN/Download.html after September 15, 2022. For existing installations, update the WIBU CodeMeter Runtime separately with at least version 7.30a downloaded from the WIBU Systems website. Please refer to the WIBU CodeMeter documentation and website for further details and mitigations on usage of WIBU CodeMeter Runtime before 7.30a. MES PC If your copy of MES4 came preinstalled on a PC shipped before December 2022, you'll need to make sure this PC has at least CodeMeter Runtime 7.30a installed. If necessary, download the update from the WIBU Systems website. Additional to the above: Festo strongly recommends to restrict unprivileged access to machines running Festo software and to minimize and protect network access to connected devices with state of the art techniques and processes. For a secure operation follow the recommendations in the product manuals.

Risk evaluation

Incomplete user documentation of undocumented, authenticated test mode and further remote accessible functions. The supported features may be covered only partly by the corresponding user documentation. Festo developed the products according to the respective state of the art. As a result, the protocols used no longer fully meet today's security requirements. The products are designed and developed for use in sealed-off (industrial) networks. If the network is not adequately sealed off, unauthorized access to the product can cause damage or malfunctions, particularly Denial of Service (DoS) or loss of integrity.

Mitigatiesamenvatting

Update of user documentation in next product version.

Risk evaluation

A vulnerability in the Video.js package could allow a user of LX Appliance, with a high privilege account (i.e., with the "Teacher" role), to craft a malicious course and launch an XSS attack.

Mitigatiesamenvatting

Contact Festo Didactic services department at services.didactic@festo.com to update your LX Appliance to the latest version.

Risk evaluation

A vulnerability was reported in Siemens TIA Portal. TIA Portal is part of the installation packages of several Festo Didactic products. TP 260 before June 2023 and MES PC based on DELL XE3 contain a vulnerable versions of TIA Portal V15 to V18. Affected products of TIA Portal contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system.

Mitigatiesamenvatting

Update TIA-Portal. Please refer to Siemens SSA-116924 for more details.

Risk evaluation

The affected product families are cameras SBOC/SBOI and the Controller SBRD. The vulnerabilities are located within the Ethernet IP Stack from EIPStackGroup OpENer Ethernet/IP.

Mitigatiesamenvatting

- Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet. - Deactivate EtherNet/IP in device settings if not used

Risk evaluation

Unauthenticated access to critical webpage functions (e.g. reboot) may cause a denial of service of the device.

Mitigatiesamenvatting

Currently no fix is planned. Festo recommends limiting access to the webserver (tcp port 80) of the device to what is absolutely necessary. Replace CPX-CEC-C1 with follow-up product CPX-CEC-C1-V3. Replace CPX-CMXX with follow up product CPX-CEC-M1-V3.

Risk evaluation

The Festo controller CECC product family in firmware version 2.4.2.0 is affected by multiple vulnerabilities in the CODESYS V3 runtime.

Mitigatiesamenvatting

No fix planned. This issue will be handled with next hardware generation release.

Risk evaluation

The Festo controller CECC-X-M1 product family in multiple versions are affected by a preauthentication command injection vulnerability. Update A, 2022-07-05 Remediation has been updated. Fixed firmwares are now available.

Mitigatiesamenvatting

Please update to firmware versions as described below: | Product | Product Details | Fixed in version | |-----------------------------|-----------------------------------------------------------|------------------| | Controller CECC-X-M1 | Festo:Partnumber:4407603 Festo:Ordercode:CECC-X-M1 | 3.8.18 | | Controller CECC-X-M1 | Festo:Partnumber:8124922 Festo:Ordercode:CECC-X-M1 | 4.0.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:4407605 Festo:Ordercode:CECC-X-M1-MV | 3.8.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:8124923 Festo:Ordercode:CECC-X-M1-MV | 4.0.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:4407606 Festo:Ordercode:CECC-X-M1-MV-S1 | 3.8.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:8124924 Festo:Ordercode:CECC-X-M1-MV-S1 | 4.0.18 | | Controller CECC-X-M1-YYJKP | Festo:Partnumber:4803891 Festo:Ordercode:CECC-X-M1-YYJKP | 3.8.18 | | Controller CECC-X-M1-YSL1 | Festo:Partnumber:8082793 Festo:Ordercode:CECC-X-M1-YS-L1 | 3.8.18 | | Controller CECC-X-M1-YSL2 | Festo:Partnumber:8082794 Festo:Ordercode:CECC-X-M1-YS-L2 | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8077950 Festo:Ordercode:YJKP | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8058596 Festo:Ordercode:YJKP | 3.8.18 |

Risk evaluation

A vulnerability in the Wibu CodeMeter Runtime, which is part of the installation packages of several Festo products, was found. An attacker exploiting the vulnerability in WIBU CodeMeter Runtime in server mode could gain full access to the affected server via network access without any user interaction. This could lead to remote code execution and escalation of privileges giving full admin access on the host system for an already authenticated user (logged in locally to the PC).

Mitigatiesamenvatting

Update CodeMeter Runtime to version >= 7.60c The latest version of CodeMeter Runtime can be downloaded from WIBU System's web site.

Risk evaluation

An unauthenticated attacker would be able to send crafted requests to cause the CODESYS Gateway Server V2 to allocate excessive memory or consume all available TCP client connections. Besides, passwords are insufficiently checked during login. All versions of the following CODESYS V2 product prior version V2.3.9.38 are affected: • CODESYS Gateway Server

Mitigatiesamenvatting

Enable password protection at login in case no password is set at the controller. Please note that the password configuration file is not covered by the default FFT backup and restore mechanism. You must select the related file manually.