CVE-2022-30309
published 2022-06-13CVE-2022-30309: In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port…
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.02%
85.8th percentile
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| festo | controller_cecc-x-m1 | — | — |
| festo | controller_cecc-x-m1 | 3.0.0 – 3.8.14 | — |
| festo | controller_cecc-x-m1-mv | — | — |
| festo | controller_cecc-x-m1-mv | 3.0.0 – 3.8.14 | — |
| festo | controller_cecc-x-m1-mv-s1 | — | — |
| festo | controller_cecc-x-m1-mv-s1 | 3.0.0 – 3.8.14 | — |
| festo | controller_cecc-x-m1-mv-s1_firmware | <= 3.8.14 | — |
| festo | controller_cecc-x-m1-mv-s1_firmware | — | — |
| festo | controller_cecc-x-m1-mv_firmware | <= 3.8.14 | — |
| festo | controller_cecc-x-m1-mv_firmware | — | — |
| festo | controller_cecc-x-m1-y-yjkp | 3.0.0 – 3.8.14 | — |
| festo | controller_cecc-x-m1-y-yjkp_firmware | <= 3.8.14 | — |
| festo | controller_cecc-x-m1-ys-l1 | 3.0.0 – 3.8.14 | — |
| festo | controller_cecc-x-m1-ys-l1_firmware | <= 3.8.14 | — |
| festo | controller_cecc-x-m1-ys-l2 | 3.0.0 – 3.8.14 | — |
| festo | controller_cecc-x-m1-ys-l2_firmware | <= 3.8.14 | — |
| festo | controller_cecc-x-m1_firmware | <= 3.8.14 | — |
| festo | controller_cecc-x-m1_firmware | — | — |
| festo | servo_press_kit_yjkp | 3.0.0 – 3.8.14 | — |
| festo | servo_press_kit_yjkp_firmware | <= 3.8.14 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for POST requests to the HTTP endpoint 'cecc-x-web-viewer-request-off' on Festo CECC-X-M1 controllers; unsanitized port parameter values in this request indicate exploitation attempts of CVE-2022-30309. ↗
- →Alert on OS command injection patterns (e.g., shell metacharacters) in the port field of POST requests to Festo CECC-X-M1 web endpoints, as the port syntax is not validated. ↗
- →Affected firmware versions to target for detection: Festo CECC-X-M1 family firmware version 4.0.14 and versions 3.8.14 and prior across multiple hardware variants (CECC-X-M1, CECC-X-M1-MV, CECC-X-M1-MV-S1, CECC-X-M1-YS-L1, CECC-X-M1-YS-L2, CECC-X-M1-Y-YJKP, YJKP servo press kit). ↗
- ·No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time; detection should be treated as proactive/hunting-oriented. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xm2r-2g3f-xg38: In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for
ghsa_unreviewed·2022-06-14
CVE-2022-30309 [CRITICAL] CWE-78 GHSA-xm2r-2g3f-xg38: In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
CISA ICS
FESTO Hardware Controller, Hardware Servo Press Kit
cisa_ics·2025-07-01
FESTO Hardware Controller, Hardware Servo Press Kit
ICS Advisory
##
FESTO Hardware Controller, Hardware Servo Press Kit
Release DateJuly 01, 2025
Alert CodeICSA-25-182-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: FESTO
- Equipment: Hardware Controller, Hardware Servo Press Kit
- Vulnerabilities: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to execute unauthorized system commands with root privileges.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
FESTO reports the following products are affected:
- Festo
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-06-13
Published