VulnHub

Real-time Cybersecurity News

Critical

Festo Didactic products

All CISA Advisories
PhishingCVEExploitVulnerabilityUpdateCritical

Overview

The article details a critical vulnerability (CVE-2023-26293) in Festo Didactic products, specifically related to improper input validation in Siemens TIA-Portal versions V15 to V18, which could allow attackers to create or overwrite arbitrary files. With a CVSS v3.1 score of 7.8, this vulnerability poses significant risks to engineering systems and requires immediate attention from users to mitigate potential exploitation.

Key Takeaways

  • Affected Systems: Affected products include Siemens TIA-Portal V15 prior to V17 Update 6, Siemens TIA-Portal V18 prior to V18 Update 1, all versions of Festo Hardware MES PC, and all versions of Festo Hardware TP260 (before June 2023). Vendor: Festo SE & Co. KG.
  • Action Required: Festo recommends users of affected devices to update TIA-Portal to the latest versions.
  • Timeline: Disclosed on [date]

Original Article Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Festo SE & Co. KG Equipment: Didactic products Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow the creation or overwriting of arbitrary files in the engineering system. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Festo reports that the following products contain affected versions of Siemens TIA-Portal: Siemens TIA-Portal V15 prior to V17 Update 6 installed on Festo Hardware MES PC: All versions Siemens TIA-Portal V18 prior to V18 Update 1 installed on Festo Hardware MES PC: All versions Siemens TIA-Portal V15 prior to V17 Update 6 installed on Festo Hardware TP260 (<June2023): All versions Siemens TIA-Portal V18 prior to V18 Update 1 installed on Festo Hardware TP260 (<June2023): All versions 3.2 VULNERABILITY OVERVIEW 3.2.1 Improper Input Validation CWE-20 A vulnerability has been identified in Siemens Totally Integrated Automation Portal (TIA Portal) V15, V16, V17, and V18. The affected products contain a path traversal vulnerability that could allow the creation or overwriting of arbitrary files in the engineering system. If the user is tricked into opening a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution. CVE-2023-26293 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Communications, Critical Manufacturing, Energy COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: Germany 3.4 RESEARCHER Festo coordinated this vulnerability with CERT@VDE. 4. MITIGATIONS Festo recommends users of affected devices update TIA-Portal. Refer to Siemens SSA-116924 for more details. For more information, see the associated Festo SE & Co. KG security advisory FSA-202303 FSA-202303: Festo: Vulnerable Siemens TIA-Portal in multiple Festo Didactic products - HTML and FSA-202303: Festo: Vulnerable Siemens TIA-Portal in multiple Festo Didactic products - CSAF. CISA recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. 5. UPDATE HISTORY November 20, 2025: Initial Republication of Festo FSA-202303

Impact

Affected products include Siemens TIA-Portal V15 prior to V17 Update 6, Siemens TIA-Portal V18 prior to V18 Update 1, all versions of Festo Hardware MES PC, and all versions of Festo Hardware TP260 (before June 2023). Vendor: Festo SE & Co. KG.

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on [date]

Remediation

Festo recommends users of affected devices to update TIA-Portal to the latest versions. Specifically, users should update to Siemens TIA-Portal V17 Update 6 or later and Siemens TIA-Portal V18 Update 1 or later. For further details, refer to Siemens SSA-116924 and Festo's security advisory FSA-202303.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing, CVE, Exploit, and 3 more.

Read Original Article

Related Coverage

CISOs Feel the Heat Over AI Risk

darkreading

As companies increasingly adopt artificial intelligence technologies, Chief Information Security Officers (CISOs) are feeling the pressure. A recent survey revealed that 26% of these top security executives are contemplating leaving their roles due to the heightened demands and risks associated with AI. This shift in focus comes as organizations scramble to integrate AI tools while also managing potential vulnerabilities and security threats that could arise from their use. The concerns reflect a broader challenge in balancing innovation with security, as companies must ensure they are protecting sensitive data and maintaining compliance amidst rapid technological changes. The implications of this trend could lead to a shake-up in security leadership and strategy as organizations seek to address both the opportunities and risks presented by AI.

Jul 20, 2026

Attackers Combo Up Evasion Tactics for BEC Phishing

darkreading

A new phishing campaign, dubbed 'The TFF Trap', employs sophisticated evasion tactics to execute business email compromise (BEC) attacks. This method utilizes fileless techniques and low-detection loaders to deploy various remote access trojans (RATs) and stealers, including Agent Tesla, Remcos, XWorm, and Best Private Logger. The attackers aim to infiltrate corporate networks and steal sensitive information. Organizations should be on high alert, as these tactics make it challenging for traditional security measures to detect the malicious activities. Companies must bolster their email security practices and educate employees on recognizing phishing attempts to mitigate the risks associated with this evolving threat.

Jul 20, 2026

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

The Hacker News

Researchers have identified around 7,600 malicious repositories on GitHub as part of a campaign called FakeGit. Over 800 of these repositories masquerade as AI projects or Model Context Protocol (MCP) servers, with the aim of distributing SmartLoader malware. This malware targets users by using copied projects and convincing documentation to lure them into downloading harmful files. The campaign is particularly concerning because it exploits the popularity of AI and related technologies, making it more likely for unsuspecting developers and users to fall victim. As a result, it’s crucial for individuals and organizations to be vigilant when downloading software from GitHub and to verify the authenticity of repositories before engaging with them.

Jul 20, 2026

Director of Commerce AI standards office out after three months

CyberScoop

The Director of the newly formed Center for AI Standards and Innovation, part of the Department of Commerce, has left the position after just three months. This center was established to evaluate the risks and challenges associated with artificial intelligence technologies. The sudden departure raises questions about leadership stability and the future direction of the center, which plays a pivotal role in shaping federal AI policy. With AI systems increasingly integrated into various sectors, effective oversight is crucial to mitigate potential harms. The vacancy may hinder efforts to develop comprehensive standards that ensure AI technologies are safe and beneficial for society.

Jul 20, 2026

Cruciferra Crypter Uses Process Ghosting to Evade Detection

Infosecurity Magazine

Researchers have identified a new crypter known as Cruciferra that employs advanced techniques to evade detection by security software. This crypter utilizes a method called process ghosting, along with 90 custom ciphers, to obscure malicious payloads for various cyber actors. The ability to hide effectively means that malware can be deployed without triggering alarms, making it a significant concern for cybersecurity professionals. The techniques used by Cruciferra can complicate the detection and analysis of threats, potentially allowing attackers to compromise systems more easily. As this method becomes more widespread, organizations need to enhance their defenses and monitoring to counteract these stealthy tactics.

Jul 20, 2026

ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875)

Help Net Security

A critical vulnerability in the ServiceNow AI Platform, identified as CVE-2026-6875, is being actively exploited by attackers. This pre-authentication code injection flaw allows unauthenticated users to escape the platform's script sandbox and execute arbitrary code on targeted instances. Researchers from Searchlight Cyber discovered this vulnerability and reported it to ServiceNow in early April 2026. The exploitation of this vulnerability poses significant risks to organizations using the ServiceNow AI Platform, as it could lead to unauthorized access and control over sensitive workflows and data. Companies are urged to take immediate action to safeguard their systems against potential attacks.

Jul 20, 2026