CVE-2014-0760: Festo CECX-X-(C1/M1) Controller Improper Authentication
The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
Other sources
The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0760?
CVE-2014-0760 has been assigned a high severity level due to the potential for remote code execution and denial of service.
How do I fix CVE-2014-0760?
To fix CVE-2014-0760, it is recommended to update the firmware for the affected Festo controllers and disable FTP access if it is not needed.
What products are affected by CVE-2014-0760?
CVE-2014-0760 affects the Festo CECX-X-C1 and CECX-X-M1 Modular Controllers along with CoDeSys runtime systems and SoftMotion.
What types of attacks can exploit CVE-2014-0760?
Attackers can exploit CVE-2014-0760 to execute arbitrary code or cause application crashes via the undocumented FTP access method.
Is CVE-2014-0760 specific to a certain version of CoDeSys?
CVE-2014-0760 is not version-specific; it impacts all versions of CoDeSys runtime systems associated with the affected devices.