Festo Controller Cecc-Lk Firmware vulnerabilities

2 CVEs affecting Festo Controller Cecc-Lk Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-12069, published 2022-12-26.

More from Festo.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-3270, published 2022-12-01. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidentiality, integrity and availability.
• CVE-2020-12069, published 2022-12-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can…