View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 7.1
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Hitachi Energy
• Equipment: Relion 670/650 and SAM600-IO series
• Vulnerability: Improper Check for Unusual or Exceptional Conditions

2. RISK EVALUATION

An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to improper disk space management.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Hitachi Energy reports that the following products are affected:

• Hitachi Energy Relion 650: version 1.0.0 up to and not including 2.0.0
• Hitachi Energy Relion 650: version 2.1.0 up to 2.2.0
• Hitachi Energy Relion 650: version 2.2.0 up to 2.2.0.13
• Hitachi Energy Relion 650: version 2.2.1.0 up to and including 2.2.1.8
• Hitachi Energy Relion 650: version 2.2.4.0 up to and including 2.2.4.5
• Hitachi Energy Relion 650: version 2.2.5.0 up to and including 2.2.5.7
• Hitachi Energy Relion 650: version 2.2.6.0 up to and including 2.2.6.3
• Hitachi Energy Relion 670: version 1.0.0 up to 2.0.0
• Hitachi Energy Relion 670: version 2.0.0 up to 2.1.0
• Hitachi Energy Relion 670: version 2.1.0 up to 2.2.0
• Hitachi Energy Relion 670: version 2.2.0 up to and including 2.2.0.13
• Hitachi Energy Relion 670: version 2.2.1.0 up to and including 2.2.1.8
• Hitachi Energy Relion 670: version 2.2.2.0 up to and including 2.2.2.6
• Hitachi Energy Relion 670: version 2.2.3.0 up to and including 2.2.3.7
• Hitachi Energy Relion 670: version 2.2.4.0 up to and including 2.2.4.5
• Hitachi Energy Relion 670: version 2.2.5.0 up to and including 2.2.5.7
• Hitachi Energy Relion 670: version 2.2.6.0 up to and including 2.2.6.3
• Hitachi Energy SAM600-IO: version 2.2.1.0 up to and including 2.2.1.6
• Hitachi Energy SAM600-IO: version 2.2.5.0 up to and including 2.2.5.7

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER CHECK FOR UNUSUAL OR EXCEPTIONAL CONDITIONS CWE-754

An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to improper disk space management.

CVE-2025-1718 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

A CVSS v4 score has also been calculated for CVE-2025-1718. A base score of 7.1 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Energy
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Switzerland

3.4 RESEARCHER

Hitachi Energy PSIRT reported this vulnerability to CISA.

4. MITIGATIONS

Hitachi Energy has identified the following specific workarounds and mitigations users can apply to reduce risk:

• Relion 670 series version 2.2.6 revisions up to 2.2.6.3, Relion 650 series version 2.2.6 revisions up to 2.2.6.3: Update to version 2.2.6.4 (when available) or latest
• Relion 670 series version 2.2.5 revisions up to 2.2.5.7, Relion 650 series version 2.2.5 revisions up to 2.2.5.7, SAM600-IO series version 2.2.5 revisions up to 2.2.5.7: Update to version 2.2.5.8 or latest
• Relion 670 series version 2.2.6 revisions up to 2.2.6.3, Relion 650 series version 2.2.6 revisions up to 2.2.6.3, Relion 670 series version 2.2.5 revisions up to 2.2.5.7, Relion 650 series version 2.2.5 revisions up to 2.2.5.7, SAM600-IO series version 2.2.5 revisions up to 2.2.5.7: Upgrade to version 2.2.7
• All affected products: Apply general mitigation factors

For more information see the associated Hitachi Energy PSIRT security advisory 8DBD000174 Cybersecurity Advisory - Reboot Vulnerability in Hitachi Energy Relion 670/650 and SAM600-IO series products.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• July 03, 2025: Initial Republication of Hitachi Energy Advisory 8DBD000174

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 6.9
• ATTENTION: Exploitable remotely/Low attack complexity
• Vendor: Mitsubishi Electric Corporation
• Equipment: MELSEC iQ-F Series
• Vulnerability: Overly Restrictive Account Lockout Mechanism

2. RISK EVALUATION

Successful exploitation of this vulnerability could result in a denial-of-service condition for legitimate users for a certain period by repeatedly attempting to log in with incorrect passwords. When the product repeatedly receives unauthorized logins from an attacker, legitimate users will be unable to be authenticated until a certain period has passed after the lockout or until the product is reset.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following version of MELSEC iQ-F Series is affected:

• FX5U-32MT/ES: All versions
• FX5U-32MT/DS: All versions
• FX5U-32MT/ESS: All versions
• FX5U-32MT/DSS: All versions
• FX5U-32MR/ES: All versions
• FX5U-32MR/DS: All versions
• FX5U-64MT/ES: All versions
• FX5U-64MT/DS: All versions
• FX5U-64MT/ESS: All versions
• FX5U-64MT/DSS: All versions
• FX5U-64MR/ES: All versions
• FX5U-64MR/DS: All versions
• FX5U-80MT/ES: All versions
• FX5U-80MT/DS: All versions
• FX5U-80MT/ESS: All versions
• FX5U-80MT/DSS: All versions
• FX5U-80MR/ES: All versions
• FX5U-80MR/DS: All versions
• FX5UC-32MT/D: All versions
• FX5UC-32MT/DSS: All versions
• FX5UC-64MT/D: All versions
• FX5UC-64MT/DSS: All versions
• FX5UC-96MT/D: All versions
• FX5UC-96MT/DSS: All versions
• FX5UC-32MT/DS-TS: All versions
• FX5UC-32MT/DSS-TS: All versions
• FX5UC-32MR/DS-TS: All versions
• FX5UJ-24MT/ES: All versions
• FX5UJ-24MT/DS: All versions
• FX5UJ-24MT/ESS: All versions
• FX5UJ-24MT/DSS: All versions
• FX5UJ-24MR/ES: All versions
• FX5UJ-24MR/DS: All versions
• FX5UJ-40MT/ES: All versions
• FX5UJ-40MT/DS: All versions
• FX5UJ-40MT/ESS: All versions
• FX5UJ-40MT/DSS: All versions
• FX5UJ-40MR/ES: All versions
• FX5UJ-40MR/DS: All versions
• FX5UJ-60MT/ES: All versions
• FX5UJ-60MT/DS: All versions
• FX5UJ-60MT/ESS: All versions
• FX5UJ-60MT/DSS: All versions
• FX5UJ-60MR/ES: All versions
• FX5UJ-60MR/DS: All versions
• FX5UJ-24MT/ES-A: All versions
• FX5UJ-24MR/ES-A: All versions
• FX5UJ-40MT/ES-A: All versions
• FX5UJ-40MR/ES-A: All versions
• FX5UJ-60MT/ES-A: All versions
• FX5UJ-60MR/ES-A: All versions
• FX5S-30MT/ES: All versions
• FX5S-30MT/DS: All versions
• FX5S-30MT/ESS: All versions
• FX5S-30MT/DSS: All versions
• FX5S-30MR/ES: All versions
• FX5S-30MR/DS: All versions
• FX5S-40MT/ES: All versions
• FX5S-40MT/DS: All versions
• FX5S-40MT/ESS: All versions
• FX5S-40MT/DSS: All versions
• FX5S-40MR/ES: All versions
• FX5S-40MR/DS: All versions
• FX5S-60MT/ES: All versions
• FX5S-60MT/DS: All versions
• FX5S-60MT/ESS: All versions
• FX5S-60MT/DSS: All versions
• FX5S-60MR/ES: All versions
• FX5S-60MR/DS: All versions
• FX5S-80MT/ES: All versions
• FX5S-80MT/ESS: All versions
• FX5S-80MR/ES: All versions
• FX5-CCLGN-MS: All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 OVERLY RESTRICTIVE ACCOUNT LOCKOUT MECHANISM CWE-645

A denial-of-service (DoS) vulnerability exists in the MELSEC iQ-F series due to an overly restrictive account lockout mechanism. A remote attacker could lockout a legitimate user for a certain period of time by repeatedly attempting to login with an incorrect password.

CVE-2025-5241 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

A CVSS v4 score has also been calculated for CVE-2025-5241. A base score of 6.9 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

Thai Do, Minh Pham, Quan Le, and Loc Nguyen of OPSWAT Unit 515 reported this vulnerability to Mitsubishi Electric.

4. MITIGATIONS

Mitsubishi Electric Corporation has stated there are no plans to release a fixed version. Implement the following mitigation measures to minimize the risk of exploiting this vulnerability:

• Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.
• Use within a LAN and block access from untrusted networks and hosts through firewalls.
• Restrict physical access to the affected products and the LAN that is connected to them.
• Use IP filter function to block access from untrusted hosts.
  • NOTE: For details on the IP filter function, please refer to the following manual for each product.
  • "13.1 IP Filter Function" in the MELSEC iQ-F FX5 User's Manual (Communication)
  • "4.5 Security" in the MELSEC iQ-F FX5 CC-Link IE TSN Master/Local Module User's Manual

Mitsubishi Electric Corporation recommends downloading the manual from the following Mitsubishi Electric Website.

See Mitsubishi Electric's security bulletin for more information.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
• When remote access is required, use more secure methods, such as VPNs, recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• July 3, 2025: Initial Republication of Mitsubishi Electric 2025-005

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 8.1
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Mitsubishi Electric
• Equipment: MELSOFT Update Manager
• Vulnerabilities: Integer Underflow (Wrap or Wraparound), Protection Mechanism Failure

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, disclose information, alter information, or cause a denial-of-service (DoS) condition.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of Mitsubishi Electric MELSOFT Update Manager are affected:

• MELSOFT Update Manager SW1DND-UDM-M: Versions 1.000A to 1.012N

3.2 VULNERABILITY OVERVIEW

3.2.1 INTEGER UNDERFLOW (WRAP OR WRAPAROUND) CWE-191

Mitsubishi Electric MELSOFT Update Manager is vulnerable to an Integer Underflow vulnerability in 7-zip, included in MELSOFT Update Manager, that could allow a remote attacker to execute arbitrary code by decompressing a specially crafted compressed file. As a result, the attacker may disclose, tamper with information, or cause a denial-of-service (DoS) condition on the product.

CVE-2024-11477 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.2 PROTECTION MECHANISM FAILURE CWE-693

Mitsubishi Electric MELSOFT Update Manager is vulnerable to an Protection Mechanism Failure vulnerability in 7-zip, included in MELSOFT Update Manager, that could allow an attacker to execute arbitrary code by decompressing a specially crafted compressed file. As a result, the attacker may disclose, tamper with information, or cause a denial-of-service (DoS) condition on the product.

CVE-2025-0411 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

Mitsubishi Electric reported these vulnerabilities to CISA.

4. MITIGATIONS

Mitsubishi Electric recommends users take the following actions to minimize the risk of exploiting these vulnerabilities.

For users in Japan:

• Download version 1.013P or later from the download site below and follow the update procedure below (Note). Additionally, please verify the authenticity of the following download site in advance.
• Download Site (in Japanese)

Update Procedure:

• Extract the downloaded file (in zip format).
• Run "setup.exe" in the extracted folder to install.
• Note: If you are using MELSOFT Update Manager version 1.012N and prior, please do not connect to the internet until the above update is complete. There is a risk that these vulnerabilities could be exploited.

For users outside Japan:

• For information about how to install the fixed version, please contact your local Mitsubishi Electric representative.

For users who cannot immediately update the product, Mitsubishi Electric recommends the following mitigation measures to minimize the risk of exploiting these vulnerabilities.

• Use the PC with the affected product within the LAN and block remote logins from untrusted networks, hosts, and users.
• When connecting the PC with the affected product to the internet, use a firewall, virtual private network (VPN), etc. to prevent unauthorized access and allow only trusted users to remote login.
• Restrict physical access to the PC with the affected product and the network to which the PC is connected to, to prevent unauthorized physical access .
• Do not click on web links in emails from untrusted sources. Also, do not open attachments in untrusted emails.
• Install antivirus software on the PC with the affected product.

For more information, see Mitsubishi Electric 2025-006.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities have a high attack complexity.

5. UPDATE HISTORY

• July 3, 2025: Initial Republication of Mitsubishi Electric 2025-006

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. 

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. 

CISA released seven Industrial Control Systems (ICS) advisories on July 1, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

• ICSA-25-182-01 FESTO Didactic CP, MPS 200, and MPS 400 Firmware
• ICSA-25-182-02 FESTO Automation Suite, FluidDraw, and Festo Didactic Products
• ICSA-25-182-03 FESTO CODESYS
• ICSA-25-182-04 FESTO Hardware Controller, Hardware Servo Press Kit
• ICSA-25-182-05 Voltronic Power and PowerShield UPS Monitoring Software
• ICSA-25-182-06 Hitachi Energy Relion 670/650 and SAM600-IO Series
• ICSA-25-182-07 Hitachi Energy MSM 

CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations.

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 9.8
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: FESTO, FESTO Didactic
• Equipment: CIROS Studio / Education, Automation Suite, FluidDraw, FluidSIM, MES-PC
• Vulnerability: Out-of-bounds Write

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to gain full control of the host system, including remote code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

FESTO, FESTO Didactic reports that the following products are affected:

• FESTO Didactic CIROS Studio / Education: 6.0.0 - 6.4.6
• FESTO Didactic CIROS Studio / Education: 7.0.0 - 7.1.7
• FESTO Festo Automation Suite: <= 2.6.0.481
• FESTO FluidDraw: P6 <= 6.2k
• FESTO FluidDraw: 365 <= 7.0a
• FESTO Didactic FluidSIM: 5 all versions
• FESTO Didactic FluidSIM: 6 <= 6.1c
• FESTO Didactic MES-PC: shipped before December 2023

3.2 VULNERABILITY OVERVIEW

3.2.1 OUT-OF-BOUNDS WRITE CWE-787

A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.

CVE-2023-3935 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 PRODUCT IMPACT

Product-specific impact for an affected product vulnerable to the CVE:

• CVE-2023-3935
• (FESTO FluidDraw; FESTO FluidDraw; FESTO Festo Automation Suite): A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.4 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Germany

3.5 RESEARCHER

CERT@VDE coordinated with and supported Festo in the publication of FSA-202305.

4. MITIGATIONS

FESTO, FESTO Didactic have identified the following specific workarounds and mitigations users can apply to reduce risk:

• FESTO Didactic CIROS Studio / Education 6.0.0 - 6.4.6, FESTO Didactic FluidSIM 5 all versions, FESTO Didactic FluidSIM 6 <= 6.1c, FESTO Didactic CIROS Studio / Education 7.0.0 - 7.1.7, FESTO Didactic MES-PC shipped before December 2023: Update CodeMeter Runtime to version >= 7.60c The latest version of CodeMeter Runtime can be downloaded from WIBU System's web site.
• FESTO Festo Automation Suite <= 2.6.0.481: Planned Fix in Summer Release 2024
• FESTO FluidDraw P6 <= 6.2k, FESTO FluidDraw 365 <= 7.0a: Update to the latest version.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• July 1, 2025: Initial Republication of Festo SE & Co. KG FSA-202305

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 9.8
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: FESTO
• Equipment: CODESYS
• Vulnerabilities: Partial String Comparison, Uncontrolled Resource Consumption, Memory Allocation with Excessive Size Value

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to block legitimate user connections, crash the application, or authenticate without proper credentials.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

FESTO reports that the following products are affected:

• FESTO CODESYS Gateway Server V2: All versions
• FESTO CODESYS Gateway Server V2: prior to V2.3.9.38

3.2 VULNERABILITY OVERVIEW

3.2.1 PARTIAL STRING COMPARISON CWE-187

In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only part of the specified password is being compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.

CVE-2022-31802 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.2 UNCONTROLLED RESOURCE CONSUMPTION CWE-400

In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users or clients from establishing a new connection to the CODESYS Gateway Server V2. Existing connections are not affected and therefore remain intact.

CVE-2022-31803 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

3.2.3 MEMORY ALLOCATION WITH EXCESSIVE SIZE VALUE CWE-789

The CODESYS Gateway Server V2 does not verify the size of a request is within expected limits. An unauthenticated attacker may allocate an arbitrary amount of memory, which may lead to a crash of the Gateway due to an out-of-memory condition.

CVE-2022-31804 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

CERT@VDE coordinated with and supported Festo in the publication of FSA-202406.

4. MITIGATIONS

FESTO recommends users enable password protection at login in case no password is set at the controller. Please note the password configuration file is not covered by the default FFT backup and restore mechanism. The related file must be selected manually.

For more information see the associated Festo SE security advisory FSA-202406: Several Codesys Gateway v2 vulnerabilities in Codesys provided by Festo PDF or VDE-2024-059: Several Codesys Gateway v2 vulnerabilities in Codesys provided by Festo.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

• July 1, 2025: Initial Republication of Festo SE & Co. KG FSA-202306

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 9.8
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: FESTO Didactic
• Equipment: CP, MPS 200, MPS 400
• Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

FESTO Didactic reports that the following products are affected:

• FESTO Didactic Firmware Siemens Simatic S7-1500 / ET200SP (< V2.9.2) installed on FESTO Didactic CP including S7 PLC(All versions): All versions
• FESTO Didactic Firmware Siemens Simatic S7-1500 / ET200SP (< V2.9.2) installed on FESTO Didactic MPS 200 Systems(All versions): All versions
• FESTO Didactic Firmware Siemens Simatic S7-1500 / ET200SP (< V2.9.2) installed on FESTO Didactic MPS 400 Systems(All versions): All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119

SIMATIC S7-1200 and S7-1500 CPU products contain a memory protection bypass vulnerability that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks. Siemens has released updates for several affected products and strongly recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

CVE-2020-15782 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

CERT@VDE coordinated with and supported Festo in the publication of FSA-202405.

4. MITIGATIONS

FESTO Didactic has identified the following specific workarounds and mitigations users can apply to reduce risk:

• (Product Group: FESTO Didactic Firmware Siemens Simatic S7-1500 / ET200SP (< V2.9.2) installed on FESTO Didactic CP including S7 PLC(All versions), FESTO Didactic Firmware Siemens Simatic S7-1500 / ET200SP (< V2.9.2) installed on FESTO Didactic MPS 200 Systems(All versions), FESTO Didactic Firmware Siemens Simatic S7-1500 / ET200SP (< V2.9.2) installed on FESTO Didactic MPS 400 Systems(All versions)), All affected products: Update Siemens Simatic S7-1500 / ET200SP Firmware to V2.9.2 or or higher

The following product versions have been fixed:

• Siemens Simatic S7-1500 / ET200SP V2.9.2 installed on FESTO Didactic CP including S7 PLC are fixed versions for CVE-2020-15782
• Siemens Simatic S7-1500 / ET200SP V2.9.2 installed on FESTO Didactic MPS 200 Systems are fixed versions for CVE-2020-15782
• Siemens Simatic S7-1500 / ET200SP V2.9.2 installed on FESTO Didactic MPS 400 Systems are fixed versions for CVE-2020-15782

For more information see the associated Festo SE & Co. KG security advisory FSA-202405 VDE-2024-055: Festo: Siemens S7-1500/ET200SP CPU used in Festo Didactic products contains a memory protection bypass vulnerability.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• July 1, 2025: Initial Republication of Festo SE & Co. KG FSA-202405

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 9.8
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: FESTO
• Equipment: Hardware Controller, Hardware Servo Press Kit
• Vulnerabilities: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to execute unauthorized system commands with root privileges.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

FESTO reports the following products are affected:

• Festo Firmware installed on Festo Hardware Controller CECC-X-M1: Version 4.0.14
• Festo Firmware installed on Festo Hardware Controller CECC-X-M1: Versions 3.8.14 and prior
• Festo Firmware installed on Festo Hardware Controller CECC-X-M1-MV: Versions 3.8.14 and prior
• Festo Firmware installed on Festo Hardware Controller CECC-X-M1-MV: Version 4.0.14
• Festo Firmware installed on Festo Hardware Controller CECC-X-M1-MV-S1: Version 4.0.14
• Festo Firmware installed on Festo Hardware Controller CECC-X-M1-MV-S1: Versions 3.8.14 and prior
• Festo Firmware installed on Festo Hardware Controller CECC-X-M1-YS-L1: Versions 3.8.14 and prior
• Festo Firmware installed on Festo Hardware Controller CECC-X-M1-YS-L2: Versions 3.8.14 and prior
• Festo Firmware installed on Festo Hardware Controller CECC-X-M1-Y-YJKP: Versions 3.8.14 and prior
• Festo Firmware installed on Festo Hardware Servo Press Kit YJKP: Versions 3.8.14 and prior
• Festo Firmware installed on Festo Hardware Servo Press Kit YJKP-: Versions 3.8.14 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78

In multiple versions of Festo Controller CECC-X-M1 product family, the http-endpoint "cecc-x-refresh-request" POST request doesn't check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

CVE-2022-30311 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.2 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78

In multiple versions of Festo Controller CECC-X-M1 product family, the http-endpoint "cecc-x-acknerr-request" POST request doesn't check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

CVE-2022-30310 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.3 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78

In multiple versions of Festo Controller CECC-X-M1 product family, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn't check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

CVE-2022-30309 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.4 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78

In multiple versions of Festo Controller CECC-X-M1 product family, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn't check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

CVE-2022-30308 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Q. Kaiser and M. Illes of ONEKEY Research Labs reported these vulnerabilities to Festo. CERT@VDE coordinated with and supported Festo in the publication of FSA-202201.

4. MITIGATIONS

FESTO recommends users update to Firmware CECC-X 4.0.18 or later versions.

For more information see the associated Festo SE & Co. KG security advisory FSA-202201 VDE-2022-020: Festo: CECC-X-M1 - command injection vulnerabilities.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

• July 1, 2025: Initial Republication of Festo SE & Co. KG FSA-202201