CVE-2014-0769

Festo CECX-X-(C1/M1) Controller Improper Authentication

Description

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001.

Remediation

Workaround:

  • Festo has decided not to resolve these vulnerabilities, placing critical infrastructure asset owners using this product at risk. This advisory is being published to alert critical infrastructure asset owners of the risk of using this equipment, and to increase compensating security measures if possible. Some of these compensating measures can be: * Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet. * Locate control system networks and remote devices behind firewalls, and isolate them from the business network. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices. * Investigate the practicality of configuring and deploying an intrusion detection system (IDS) to log and monitor the control system network, as well as adjacent networks. * Configure, activate, and test existing defenses, such as port security and traffic logging, among other defensive strategies in the recommended practices document listed below.

Category

9.3
CVSS
Severity: Critical
CVSS 2.0 •
EPSS 0.33%
Affected: Festo CECX-X-C1 Modular Master Controller with CoDeSys
Affected: Festo CECX-X-M1 Modular Controller with CoDeSys and SoftMotion
Published at:
Updated at:

References

Frequently Asked Questions

What is the severity of CVE-2014-0769?
CVE-2014-0769 has been scored as a critical severity vulnerability.
How to fix CVE-2014-0769?
As a workaround for remediating CVE-2014-0769: Festo has decided not to resolve these vulnerabilities, placing critical infrastructure asset owners using this product at risk. This advisory is being published to alert critical infrastructure asset owners of the risk of using this equipment, and to increase compensating security measures if possible. Some of these compensating measures can be: * Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet. * Locate control system networks and remote devices behind firewalls, and isolate them from the business network. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices. * Investigate the practicality of configuring and deploying an intrusion detection system (IDS) to log and monitor the control system network, as well as adjacent networks. * Configure, activate, and test existing defenses, such as port security and traffic logging, among other defensive strategies in the recommended practices document listed below.
Is CVE-2014-0769 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2014-0769 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2014-0769?
CVE-2014-0769 affects Festo CECX-X-C1 Modular Master Controller with CoDeSys, Festo CECX-X-M1 Modular Controller with CoDeSys and SoftMotion.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.