Festo vulnerabilities
We track 7 vulnerabilities in Festo products across 39 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on April 16, 2026.
Latest Festo vulnerabilities
- 8.8 High severity
MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L4-AGD: Inclusion of Undocumented Features or Chicken Bits
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.
- 9.8 Critical severity
Bus module CPX-E-EP: Insufficient Technical Documentation
In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidentiality, integrity and availability.
- 7.5 High severity
Control block CPX-CEC-C1 (no. 567347): Improper Privilege Management
Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.
- 10.0 High severity
Controller CECC-X-M1 (4407603): Improper Neutralization of Special Elements used in an OS Command
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access c
- 9.8 Critical severity
Controller CECC-X-M1 (4407603): Improper Neutralization of Special Elements used in an OS Command
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access c
- 10.0 High severity
Controller CECC-X-M1 (4407603): Improper Neutralization of Special Elements used in an OS Command
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper a
- 9.8 Critical severity
Controller CECC-X-M1 (4407603): Improper Neutralization of Special Elements used in an OS Command
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper ac