critical9.8
CVE-2022-30308
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax.
Impact
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Festo | Controller Cecc-X-M1 Firmware | through 3.8.14 Version 4.0.14 |
| Festo | Controller Cecc-X-M1-Mv Firmware | through 3.8.14 Version 4.0.14 |
| Festo | Controller Cecc-X-M1-Mv-S1 Firmware | through 3.8.14 Version 4.0.14 |
| Festo | Controller Cecc-X-M1-Ys-L1 Firmware | through 3.8.14 |
| Festo | Controller Cecc-X-M1-Ys-L2 Firmware | through 3.8.14 |
| Festo | Controller Cecc-X-M1-Y-Yjkp Firmware | through 3.8.14 |
| Festo | Servo Press Kit Yjkp Firmware | through 3.8.14 |
| Festo | Servo Press Kit Yjkp- Firmware | through 3.8.14 |