CVE-2022-3079 - Vulnerability Details - OpenCVE

Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Festo	Cpx-cec-c1 Cpx-cec-c1 Firmware Cpx-cmxx Cpx-cmxx Firmware

Configuration 1 [-]

AND

cpe:2.3:o:festo:cpx-cmxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:festo:cpx-cmxx:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:festo:cpx-cec-c1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:festo:cpx-cec-c1:-:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-42508	Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2022-036

History

Thu, 29 May 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2022-09-20T10:10:17.000Z

Updated: 2025-05-29T14:09:35.704Z

Reserved: 2022-09-01T00:00:00.000Z

Link: CVE-2022-3079

Vulnrichment

Updated: 2024-08-03T01:00:10.805Z

NVD

Status : Modified

Published: 2022-09-20T10:15:10.587

Modified: 2024-11-21T07:18:46.800

Link: CVE-2022-3079

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Control block CPX-CEC-C1 (no. 567347)", "vendor": "FESTO", "versions": [{"lessThanOrEqual": "2.0.12", "status": "affected", "version": "0.0.1", "versionType": "custom"}]}, {"product": "Control block CPX-CMXX (no. 555667)", "vendor": "FESTO", "versions": [{"lessThanOrEqual": "1.2.34 rev.269404", "status": "affected", "version": "0.0.1", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Daniel dos Santos and Rob Hulsebos from Forescout reported to Festo"}], "descriptions": [{"lang": "en", "value": "Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-20T10:10:17.000Z", "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}], "source": {"advisory": "VDE-2022-036", "defect": ["CERT@VDE#64174"], "discovery": "EXTERNAL"}, "title": "Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "info@cert.vde.com", "ID": "CVE-2022-3079", "STATE": "PUBLIC", "TITLE": "Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Control block CPX-CEC-C1 (no. 567347)", "version": {"version_data": [{"version_affected": "<=", "version_name": "0.0.1", "version_value": "2.0.12"}]}}, {"product_name": "Control block CPX-CMXX (no. 555667)", "version": {"version_data": [{"version_affected": "<=", "version_name": "0.0.1", "version_value": "1.2.34 rev.269404"}]}}]}, "vendor_name": "FESTO"}]}}, "credit": [{"lang": "eng", "value": "Daniel dos Santos and Rob Hulsebos from Forescout reported to Festo"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-269 Improper Privilege Management"}]}]}, "references": {"reference_data": [{"name": "https://cert.vde.com/en/advisories/VDE-2022-036", "refsource": "CONFIRM", "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}]}, "source": {"advisory": "VDE-2022-036", "defect": ["CERT@VDE#64174"], "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:00:10.805Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-29T14:09:32.176624Z", "id": "CVE-2022-3079", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-29T14:09:35.704Z"}}]}, "cveMetadata": {"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "cveId": "CVE-2022-3079", "datePublished": "2022-09-20T10:10:17.000Z", "dateReserved": "2022-09-01T00:00:00.000Z", "dateUpdated": "2025-05-29T14:09:35.704Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-036", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:00:10.805Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-3079", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-29T14:09:32.176624Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-29T14:09:21.130Z"}}], "cna": {"title": "Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function", "source": {"defect": ["CERT@VDE#64174"], "advisory": "VDE-2022-036", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Daniel dos Santos and Rob Hulsebos from Forescout reported to Festo"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "FESTO", "product": "Control block CPX-CEC-C1 (no. 567347)", "versions": [{"status": "affected", "version": "0.0.1", "versionType": "custom", "lessThanOrEqual": "2.0.12"}]}, {"vendor": "FESTO", "product": "Control block CPX-CMXX (no. 555667)", "versions": [{"status": "affected", "version": "0.0.1", "versionType": "custom", "lessThanOrEqual": "1.2.34 rev.269404"}]}], "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-036", "tags": ["x_refsource_CONFIRM"]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2022-09-20T10:10:17.000Z"}, "x_legacyV4Record": {"credit": [{"lang": "eng", "value": "Daniel dos Santos and Rob Hulsebos from Forescout reported to Festo"}], "impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, "source": {"defect": ["CERT@VDE#64174"], "advisory": "VDE-2022-036", "discovery": "EXTERNAL"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_name": "0.0.1", "version_value": "2.0.12", "version_affected": "<="}]}, "product_name": "Control block CPX-CEC-C1 (no. 567347)"}, {"version": {"version_data": [{"version_name": "0.0.1", "version_value": "1.2.34 rev.269404", "version_affected": "<="}]}, "product_name": "Control block CPX-CMXX (no. 555667)"}]}, "vendor_name": "FESTO"}]}}, "data_type": "CVE", "generator": {"engine": "Vulnogram 0.0.9"}, "references": {"reference_data": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-036", "name": "https://cert.vde.com/en/advisories/VDE-2022-036", "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-269 Improper Privilege Management"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-3079", "STATE": "PUBLIC", "TITLE": "Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function", "ASSIGNER": "info@cert.vde.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-3079", "state": "PUBLISHED", "dateUpdated": "2025-05-29T14:09:35.704Z", "dateReserved": "2022-09-01T00:00:00.000Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2022-09-20T10:10:17.000Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:festo:cpx-cmxx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A734858-6728-452C-BEF4-9C638380180D", "versionEndIncluding": "2.0.12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:festo:cpx-cmxx:-:*:*:*:*:*:*:*", "matchCriteriaId": "467CCB2B-2FCC-4885-9CD3-52F312FD20B8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:festo:cpx-cec-c1_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1F679EE-D2D0-496D-AB98-70E99F285358", "versionEndIncluding": "1.2.34", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:festo:cpx-cec-c1:-:*:*:*:*:*:*:*", "matchCriteriaId": "58B42CEE-8A72-4C1D-9951-7E147282718A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service."}, {"lang": "es", "value": "El bloque de control de Festo CPX-CEC-C1 y CPX-CMXX en varias versiones, permite el acceso remoto no autenticado a funciones cr\u00edticas de la p\u00e1gina web que pueden causar una denegaci\u00f3n de servicio"}], "id": "CVE-2022-3079", "lastModified": "2024-11-21T07:18:46.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "info@cert.vde.com", "type": "Secondary"}]}, "published": "2022-09-20T10:15:10.587", "references": [{"source": "info@cert.vde.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "info@cert.vde.com", "type": "Secondary"}]}