Festo MSE6 Series Undocumented Test Mode Vulnerability (FSA-202304) Advisory

Vulnerability Summary Overview Vulnerability ID: FSA-202304 Release Date: 2023-09-05 Affected Products: Multiple Festo product series, including MSE6-CM-5000, MSE6-CM-5000-FB43, MSE6-CM-5000-FB44, MSE6-DJM-5000, MSE6-EJM-5000, MSE6-EJM-5000-FB37, etc. Vulnerability Description: In Festo's MSE6 product series, a remote authenticated attacker can exploit an undocumented test mode feature, resulting in complete loss of confidentiality, integrity, and availability. Impact Scope Affected Products: - MSE6-CM-5000-FB36-D-R-RG-BAR-M12L4-AGD - MSE6-CM-5000-FB36-D-R-RG-BAR-M12L5-AGD - MSE6-CM-5000-FB43-D-R-RG-BAR-M12L4-M01-AGD - MSE6-CM-5000-FB43-D-R-RG-BAR-M12L5-M01-AGD - MSE6-CM-5000-FB44-D-R-RG-BAR-AM1-AGD - MSE6-DJM-5000-CB05-S-RG-BAR-VCB-AGD - MSE6-EJM-5000-FB13-AGD - MSE6-EJM-5000-FB36-AGD - MSE6-EJM-5000-FB37-AGD - MSE6-EJM-5000-FB43-AGD - MSE6-EJM-5000-FB44-AGD Remediation Measures Recommended Actions: - Switch communication from untrusted networks to alternative solutions such as running VPN or IPsec-based security policies. - Protect and isolate control systems from other networks using firewalls. - Activate and apply user management and password protection. - Use encrypted communication links. - Restrict access to development and control systems through physical means, operating system features, etc. - Use up-to-date antivirus detection solutions. References CERTVE Advisory CSAF Advisory Festo Product Security Incident Response Team

Goal Reached Thanks to every supporter — we hit 100%!

Festo MSE6 Series Undocumented Test Mode Vulnerability (FSA-202304) Advisory