Unrated severityNVD Advisory· Published Jun 13, 2022· Updated Sep 16, 2024
FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability
CVE-2022-30308
Description
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
Affected products
6- Range: 3.0.0
- Range: 4.0.14
- Range: 4.0.14
- Range: 3.0.0
- Festo/Controller CECC-X-M1-MV-S1 (4407606)v5Range: 3.0.0
- Festo/Controller CECC-X-M1-Y-YJKP (4803891)v5Range: 3.0.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- cert.vde.com/en/advisories/VDE-2022-020/mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.