← CVE Intelligence

CVE-2022-30308

FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability PUBLISHED

Description (CNA)

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.

Affected (CNA)

Vendor / productVersions
Festo / Controller CECC-X-M1 (4407603)affected 3.0.0 through 3.8.14
Festo / Controller CECC-X-M1 (8124922)affected 4.0.14
Festo / Controller CECC-X-M1-MV (4407605)affected 3.0.0 through 3.8.14
Festo / Controller CECC-X-M1-MV (8124923)affected 4.0.14
Festo / Controller CECC-X-M1-MV-S1 (4407606)affected 3.0.0 through 3.8.14
Festo / Controller CECC-X-M1-MV-S1 (8124924)affected 4.0.14
Festo / Controller CECC-X-M1-YS-L1 (8082793)affected 3.0.0 through 3.8.14
Festo / Controller CECC-X-M1-YS-L2 (8082794)affected 3.0.0 through 3.8.14
Festo / Controller CECC-X-M1-Y-YJKP (4803891)affected 3.0.0 through 3.8.14
Festo / Servo Press Kit YJKP (8077950)affected 3.0.0 through 3.8.14
Festo / Servo Press Kit YJKP- (8058596)affected 3.0.0 through 3.8.14

CWE

CWE-863, CWE-78

References

ADP enrichment

CVE

No English description supplied.