{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-3634", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-07-12T12:07:06.056Z", "datePublished": "2026-04-16T04:40:29.960Z", "dateUpdated": "2026-04-16T13:51:55.114Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L4-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}, {"defaultStatus": "unaffected", "product": "MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L5-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}, {"defaultStatus": "unaffected", "product": "MSE6-C2M-5000-FB43-D-M-RG-BAR-M12L4-MQ1-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}, {"defaultStatus": "unaffected", "product": "MSE6-C2M-5000-FB43-D-M-RG-BAR-M12L5-MQ1-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}, {"defaultStatus": "unaffected", "product": "MSE6-C2M-5000-FB44-D-M-RG-BAR-AMI-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}, {"defaultStatus": "unaffected", "product": "MSE6-C2M-5000-FB44-D-RG-BAR-AMI-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}, {"defaultStatus": "unaffected", "product": "MSE6-D2M-5000-CBUS-S-RG-BAR-VCB-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}, {"defaultStatus": "unaffected", "product": "MSE6-E2M-5000-FB13-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}, {"defaultStatus": "unaffected", "product": "MSE6-E2M-5000-FB36-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}, {"defaultStatus": "unaffected", "product": "MSE6-E2M-5000-FB37-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}, {"defaultStatus": "unaffected", "product": "MSE6-E2M-5000-FB43-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}, {"defaultStatus": "unaffected", "product": "MSE6-E2M-5000-FB44-AGD", "vendor": "Festo", "versions": [{"status": "affected", "version": "*"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-c2m-5000-fb36-d-m-rg-bar-m12l4-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-c2m-5000-fb36-d-m-rg-bar-m12l5-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-c2m-5000-fb43-d-m-rg-bar-m12l4-mq1-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-c2m-5000-fb43-d-m-rg-bar-m12l5-mq1-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-c2m-5000-fb44-d-m-rg-bar-ami-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-c2m-5000-fb44-d-rg-bar-ami-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-d2m-5000-cbus-s-rg-bar-vcb-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-e2m-5000-fb13-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-e2m-5000-fb36-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-e2m-5000-fb37-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-e2m-5000-fb43-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:festo:mse6-e2m-5000-fb44-agd_firmware:*:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "datePublic": "2026-03-06T08:15:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability."}], "value": "In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1242", "description": "CWE-1242 Inclusion of Undocumented Features or Chicken Bits", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2026-04-16T04:40:29.960Z"}, "references": [{"url": "https://certvde.com/de/advisories/VDE-2023-020/"}, {"tags": ["vendor-advisory"], "url": "https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2023/fsa-202304.json"}], "source": {"advisory": "VDE-2023-020", "defect": ["CERT@VDE#64559"], "discovery": "INTERNAL"}, "title": "Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T13:51:13.277265Z", "id": "CVE-2023-3634", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:51:55.114Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability."}], "id": "CVE-2023-3634", "lastModified": "2026-04-16T05:16:12.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "info@cert.vde.com", "type": "Primary"}]}, "published": "2026-04-16T05:16:12.090", "references": [{"source": "info@cert.vde.com", "url": "https://certvde.com/de/advisories/VDE-2023-020/"}, {"source": "info@cert.vde.com", "url": "https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2023/fsa-202304.json"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1242"}], "source": "info@cert.vde.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L4-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-c2m-5000-fb36-d-m-rg-bar-m12l4-agd", "vendor": "festo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L5-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-c2m-5000-fb36-d-m-rg-bar-m12l5-agd", "vendor": "festo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-C2M-5000-FB43-D-M-RG-BAR-M12L4-MQ1-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-c2m-5000-fb43-d-m-rg-bar-m12l4-mq1-agd", "vendor": "festo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-C2M-5000-FB43-D-M-RG-BAR-M12L5-MQ1-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-c2m-5000-fb43-d-m-rg-bar-m12l5-mq1-agd", "vendor": "festo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-C2M-5000-FB44-D-M-RG-BAR-AMI-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-c2m-5000-fb44-d-m-rg-bar-ami-agd", "vendor": "festo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-C2M-5000-FB44-D-RG-BAR-AMI-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-c2m-5000-fb44-d-rg-bar-ami-agd", "vendor": "festo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-D2M-5000-CBUS-S-RG-BAR-VCB-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-d2m-5000-cbus-s-rg-bar-vcb-agd", "vendor": "festo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-E2M-5000-FB13-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-e2m-5000-fb13-agd", "vendor": "festo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-E2M-5000-FB36-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-e2m-5000-fb36-agd", "vendor": "festo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-E2M-5000-FB37-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-e2m-5000-fb37-agd", "vendor": "festo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-E2M-5000-FB43-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-e2m-5000-fb43-agd", "vendor": "festo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MSE6-E2M-5000-FB44-AGD", "source": "cna", "vendor": "Festo"}, "product": "mse6-e2m-5000-fb44-agd", "vendor": "festo"}], "analysis": {"en": {"generated_at": "2026-04-16T08:58:21.657674+00:00", "value": {"mitigation_remediation": ["Deploy the latest firmware update or patch from Festo that addresses the undocumented test\u2011mode functions.", "Remove or restrict low\u2011privileged user accounts from having access to the device\u2019s management interface, applying the principle of least privilege.", "Block network traffic to the device\u2019s test\u2011mode or management ports using firewall rules or network segmentation to prevent remote invocation.", "Monitor device logs for any use of test\u2011mode functions and investigate anomalous activity promptly."], "summary": {"action": "Immediate Patch", "impact": "Complete System Compromise"}, "threat_synthesis": {"affected_systems": "Affected products are the Festo MSE6\u2011C2M 5000 family with firmware variants FB36, FB43, and FB44; the MSE6\u2011D2M 5000 CBUS\u2011S series; and the MSE6\u2011E2M 5000 line with firmware FB13, FB36, FB37, FB43, and FB44. No further version ranges are specified beyond these firmware identifiers.", "description_and_impact": "The vulnerability is caused by incomplete user documentation that lets a remote authenticated, low\u2011privileged user invoke undocumented test\u2011mode functions on Festo MSE6 devices, potentially leading to a total loss of confidentiality, integrity, and availability. This weakness is identified as CWE\u20111242.", "risk_and_exploitability": "With a CVSS base score of 8.8 the issue is classified as high severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. Exploitation requires remote authentication at a low\u2011privileged level, meaning that legitimate users with limited access could potentially activate hidden test functions and compromise the entire system. The undocumented nature of the functions does not reduce the risk; a properly authenticated attacker can immediately use the functions and cause full system compromise."}}}}, "created": "2026-04-16T09:00:05.297582+00:00", "updated": "2026-04-16T09:11:53.757490+00:00", "vendors": ["festo", "festo$PRODUCT$mse6-c2m-5000-fb36-d-m-rg-bar-m12l4-agd", "festo$PRODUCT$mse6-c2m-5000-fb36-d-m-rg-bar-m12l5-agd", "festo$PRODUCT$mse6-c2m-5000-fb43-d-m-rg-bar-m12l4-mq1-agd", "festo$PRODUCT$mse6-c2m-5000-fb43-d-m-rg-bar-m12l5-mq1-agd", "festo$PRODUCT$mse6-c2m-5000-fb44-d-m-rg-bar-ami-agd", "festo$PRODUCT$mse6-c2m-5000-fb44-d-rg-bar-ami-agd", "festo$PRODUCT$mse6-d2m-5000-cbus-s-rg-bar-vcb-agd", "festo$PRODUCT$mse6-e2m-5000-fb13-agd", "festo$PRODUCT$mse6-e2m-5000-fb36-agd", "festo$PRODUCT$mse6-e2m-5000-fb37-agd", "festo$PRODUCT$mse6-e2m-5000-fb43-agd", "festo$PRODUCT$mse6-e2m-5000-fb44-agd"]}