The vulnerability is caused by incomplete user documentation that lets a remote authenticated, low‑privileged user invoke undocumented test‑mode functions on Festo MSE6 devices, potentially leading to a total loss of confidentiality, integrity, and availability. This weakness is identified as CWE‑1242.

Affected products are the Festo MSE6‑C2M 5000 family with firmware variants FB36, FB43, and FB44; the MSE6‑D2M 5000 CBUS‑S series; and the MSE6‑E2M 5000 line with firmware FB13, FB36, FB37, FB43, and FB44. No further version ranges are specified beyond these firmware identifiers.

With a CVSS base score of 8.8 the issue is classified as high severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. Exploitation requires remote authentication at a low‑privileged level, meaning that legitimate users with limited access could potentially activate hidden test functions and compromise the entire system. The undocumented nature of the functions does not reduce the risk; a properly authenticated attacker can immediately use the functions and cause full system compromise.