← Database
CVE-2022-30309
CRITICAL
CVSS: 9.8
Published: 2022-06-13
Modified: 2026-06-17
Description
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
Affected Platforms
Festo Controller Cecc-X-M1-Ys-L2 FirmwareFesto Controller Cecc-X-M1-MvFesto Controller Cecc-X-M1-Mv FirmwareFesto Controller Cecc-X-M1 FirmwareFesto Controller Cecc-X-M1-Mv-S1 FirmwareFesto Controller Cecc-X-M1-Y-YjkpFesto Servo Press Kit Yjkp-Festo Servo Press Kit Yjkp FirmwareFesto Controller Cecc-X-M1-Ys-L1 FirmwareFesto Controller Cecc-X-M1-Y-Yjkp Firmware
Weakness Type
CWE-78, CWE-863, CWE-78, CWE-863