title: Incomplete Documentation of remote functions in FESTO products.
description: In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented  protocol which could lead to a complete loss of confidentiality, integrity and availability.
problem types: CWE-1059  Incomplete Documentation
affected:
{
defaultStatus: affected
product: Bus module CPX-E-EP
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CPX-FB32
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CPX-FB33
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CPX-FB36
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CPX-FB37
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CPX-FB39
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CPX-FB40
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CPX-FB43
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CPX-M-FB34
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CPX-M-FB35
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CPX-M-FB44
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CPX-M-FB45
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CTEU-EP
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CTEU-PN
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus node CTEU-PN-EX1C
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Camera system CHB-C-N
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Compact Vision System SBO*-C-*
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Compact Vision System SBO*-M-*
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Compact Vision System SBO*-Q-*
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Control block CPX-CEC
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Control block CPX-CEC-C1
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Control block CPX-CEC-C1-V3
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Control block CPX-CEC-M1
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Control block CPX-CEC-M1-V3
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Control block CPX-CEC-S1-V3
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Control block CPX-CMXX
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Control block CPX-CMXX
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Control block CPX-FEC-1-IE
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Controller CECC-D
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Controller CECC-D-BA
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Controller CECC-LK
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Controller CECC-S
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Controller CECC-X-*
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Controller CECX-X-C1
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Controller CECX-X-M1
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Controller CMXH-ST2-C5-7-DIOP
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Controller CPX-E-CEC-*
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Controller SBRD-Q
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: EtherNet/IP interface CPX-AP-I-EP-M12
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: EtherNet/IP interface CPX-AP-I-PN-M12
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Gateway CPX-IOT
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Integrated drive EMCA-EC-67-*
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Motor controller CMMO-ST-C5-1-DION
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Motor controller CMMO-ST-C5-1-DIOP
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Motor controller CMMO-ST-C5-1-LKP
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Motor controller CMMP-AS-*
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Motor controller CMMT-AS-*
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Operator unit CDPX-X-A-S-10
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Operator unit CDPX-X-A-W-13
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Operator unit CDPX-X-A-W-4
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Operator unit CDPX-X-A-W-7
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Planar surface gantry EXCM-*
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Servo drive CMMT-ST-C8-1C-EP-S0
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Servo drive CMMT-ST-C8-1C-PN-S0
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: VTEM-S1-*
vendor: Festo SE
versions:
status: affected, version: all
}
{
defaultStatus: affected
product: Bus module CPX-E-PN
vendor: Festo SE
versions:
status: affected, version: all
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL