CVE-2022-30310: FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-30310?
CVE-2022-30310 is a vulnerability in the Festo Controller CECC-X-M1 product family that allows unauthorized execution of system commands with root privileges.
What is the severity of CVE-2022-30310?
CVE-2022-30310 has a severity rating of 9.8, which is considered critical.
What is the affected software for CVE-2022-30310?
The affected software for CVE-2022-30310 includes Festo Controller CECC-X-M1 firmware versions up to and including 3.8.14 and Festo Controller CECC-X-M1 firmware version 4.0.14.
How does CVE-2022-30310 exploit the vulnerability?
CVE-2022-30310 exploits the vulnerability by not checking for proper port syntax in the "cecc-x-acknerr-request" POST request, allowing unauthorized execution of system commands.
Is Festo Controller CECC-X-M1-MV and Festo Controller CECC-X-M1-MV-S1 affected by CVE-2022-30310?
No, Festo Controller CECC-X-M1-MV and Festo Controller CECC-X-M1-MV-S1 are not vulnerable to CVE-2022-30310.