CVE-2014-0760

Summary

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.

Affected Software

VendorProductVersion RangeStatus
FestoCECX-X-C1 Modular Master Controller with CoDeSysallaffected
FestoCECX-X-M1 Modular Controller with CoDeSys and SoftMotionallaffected

Weaknesses

  • CWE-287: CWE-287

Workarounds

Festo has decided not to resolve these vulnerabilities, placing critical infrastructure asset owners using this product at risk. This advisory is being published to alert critical infrastructure asset owners of the risk of using this equipment, and to increase compensating security measures if possible. Some of these compensating measures can be:

  • Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.

  • Locate control system networks and remote devices behind firewalls, and isolate them from the business network.

  • When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.

  • Investigate the practicality of configuring and deploying an intrusion detection system (IDS) to log and monitor the control system network, as well as adjacent networks.

  • Configure, activate, and test existing defenses, such as port security and traffic logging, among other defensive strategies in the recommended practices document listed below.

ADP Enrichment

CVE Program Container

Additional References

References