View CSAF

Summary

MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications. MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic’s Factory Control Panel application.

The following versions of Festo Didactic SE MES PC are affected:

• MES PC (CVE-2019-11036, CVE-2023-25727, CVE-2021-2011, CVE-2022-32083, CVE-2021-46668, CVE-2018-19518, CVE-2021-2194, CVE-2019-11049, CVE-2022-31626, CVE-2022-32084, CVE-2022-32088, CVE-2022-27377, CVE-2020-2922, CVE-2019-9638, CVE-2019-11044, CVE-2020-7068, CVE-2020-7069, CVE-2015-2301, CVE-2023-0568, CVE-2022-27458, CVE-2021-21706, CVE-2022-27452, CVE-2020-7071, CVE-2022-27387, CVE-2022-27376, CVE-2019-11043, CVE-2021-2032, CVE-2021-2007, CVE-2019-11045, CVE-2022-27445, CVE-2022-27457, CVE-2022-27384, CVE-2022-23808, CVE-2023-0567, CVE-2019-9025, CVE-2022-27379, CVE-2019-9637, CVE-2021-27928, CVE-2021-21703, CVE-2020-2760, CVE-2021-2166, CVE-2015-2787, CVE-2022-23807, CVE-2020-2752, CVE-2021-46666, CVE-2020-2814, CVE-2020-7065, CVE-2021-21705, CVE-2020-7062, CVE-2019-11039, CVE-2019-11035, CVE-2022-27447, CVE-2019-11046, CVE-2022-27446, CVE-2022-27386, CVE-2019-9639, CVE-2019-11042, CVE-2022-27385, CVE-2020-7059, CVE-2020-7070, CVE-2022-32091, CVE-2015-2348, CVE-2019-9020, CVE-2021-35604, CVE-2022-27444, CVE-2018-14883, CVE-2014-9705, CVE-2020-7064, CVE-2022-27382, CVE-2020-7063, CVE-2021-2372, CVE-2019-9021, CVE-2018-14851, CVE-2022-27448, CVE-2021-46663, CVE-2021-2180, CVE-2014-9709, CVE-2023-25690, CVE-2022-32082, CVE-2022-31629, CVE-2019-9022, CVE-2016-3078, CVE-2023-0662, CVE-2021-2022, CVE-2022-32089, CVE-2019-11048, CVE-2021-46669, CVE-2019-11047, CVE-2022-27383, CVE-2021-46667, CVE-2022-32087, CVE-2022-36760, CVE-2020-7060, CVE-2018-17082, CVE-2019-9640, CVE-2021-46661, CVE-2019-11034, CVE-2022-27456, CVE-2020-7061, CVE-2022-27455, CVE-2021-2144, CVE-2021-2154, CVE-2022-21595, CVE-2019-11040, CVE-2021-2389, CVE-2023-27522, CVE-2020-2812, CVE-2021-46665, CVE-2022-32086, CVE-2022-32085, CVE-2021-21704, CVE-2020-7066, CVE-2022-31628, CVE-2021-46662, CVE-2016-5385, CVE-2022-37436, CVE-2013-6501, CVE-2021-21702, CVE-2019-9024, CVE-2019-9023, CVE-2022-27449, CVE-2021-46664, CVE-2019-11050, CVE-2021-21708, CVE-2022-31625, CVE-2022-32081, CVE-2022-27378, CVE-2006-20001, CVE-2018-19935, CVE-2022-4900, CVE-2018-12882, CVE-2019-9641, CVE-2022-27380, CVE-2022-27381, CVE-2021-21707, CVE-2022-27451, CVE-2020-2780, CVE-2019-11041, CVE-2021-2174)

Background

• Critical Infrastructure Sectors: Commercial Facilities, Communications, Critical Manufacturing, Energy
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Germany

Vulnerabilities

Acknowledgments

• CERT@VDE helped coordinate and support this publication

General recommendation

Festo Didactic offers products with security functions that aid the safe operation of plants, systems, machines and networks. In order to protect plants, systems, machines and networks from cyber threats, a comprehensive security concept must be implemented and continuously updated. Festo products and services only constitute one part of such a concept. The customer is responsible for preventing unauthorized access to their plants, systems, machines and networks. Systems, machines and components should only be connected to a company’s network or the Internet if and as necessary, and only when the suitable security measures (e.g., firewalls and network segmentation, defense-in-depth) are in place. Failure to ensure adequate security measures when connecting the product to the network can result in vulnerabilities which allow unauthorized, remote access to the network – even beyond the product boundaries. This access could be abused to incur a loss of data or manipulate or sabotage systems. Typical forms of attack include but are not limited to: Denial-of-Service (rendering the system temporarily non-functional), remote execution of malicious code, privilege escalation (executing malicious code with higher system privileges than expected), ransomware (encryption of data and demanding payment for decryption). In the context of industrial systems and machines this can also lead to unsafe states, posing a danger to people and equipment. Furthermore, Festo guidelines on suitable security measures should be observed. Festo products and solutions are constantly being developed further in order to make them more secure. Festo strongly recommends that customers install product updates as soon as they become available and always use the latest versions of its products. Any use of product versions that are no longer supported or any failure to install the latest updates may render the customer vulnerable to cyber-attacks.

Disclaimer

Festo assumes no liability whatsoever for indirect, collateral, accidental or consequential losses that occur by the distribution and/or use of this document or any losses in connection with the distribution and/or use of this document. All information published in this document is provided free of charge and on good faith by Festo. Insofar as permissible by law, however, none of this information shall establish any warranty, guarantee, commitment, or liability on the part of Festo.nnNote: In no case does this information release the operator or responsible person from the obligation to check the effect on his system or installation before using the information and, in the event of negative consequences, not to use the information.nnIn addition, the actual general terms, and conditions for delivery, payment and software use of Festo, available under http://www.festo.com and the special provisions for the use of Festo Security Advisory available at https://www.festo.com/psirt shall apply.

Impact

The vulnerabilities covered by this advisory have a broad range of impacts ranging from denial-of-service to disclosure or manipulation/deletion of information. Given the intended usage of MES PCs for didactic purposes in controlled lab environments, separate from productive systems, it never comes into contact with sensitive information. Therefore the impact is reduced to limited availability of the system.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Festo SE & Co. KG FSA-202402 from a direct conversion of the vendor’s Common Security Advisory Framework (CSAF) advisory. This is republished to CISA’s website as a means of increasing visibility and is provided “as-is” for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Festo SE & Co. KG directly for any questions regarding this advisory.

Revision History

• Initial Release Date: 2024-02-27

Legal Notice and Terms of Use