OTPulse

Multiple OpenSSL vulnerabilities affect Festo AX OS in CEPE

Act NowCVSS 9.8FSA-202602Oct 20, 2026
Phoenix ContactFestoManufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Festo AX OS versions 25.0.1.46 and 25.9.2.4 contain multiple OpenSSL vulnerabilities (CVE-2025-15467 and CVE-2025-69419) that allow buffer overflow attacks through maliciously crafted firmware, key files, PKCS#12 files, CMS/PKCS#7 content, or digitally signed objects. Exploitation requires a logged-in user with high privileges or processing of attacker-supplied cryptographic objects.

What this means
What could happen
An attacker could upload malicious firmware or cryptographic files to execute arbitrary code on the Festo CEPE control system, potentially altering process logic, stopping operations, or gaining persistent access to manufacturing equipment controlled by the system.
Who's at risk
Manufacturing facilities using Festo CEPE production control systems based on Festo AX OS (versions 25.0.1.46 or 25.9.2.4) should prioritize this vulnerability. CEPE is commonly used in automated assembly and process control; compromise could affect production schedules, equipment safety, and data integrity in pharmaceutical, automotive, food processing, and discrete manufacturing sectors.
How it could be exploited
An attacker with network access to the CEPE system (or with local access via USB/maintenance port) could upload a maliciously crafted firmware file, key file, or PKCS#12 certificate to the device. If a logged-in user with high privileges (or if the system auto-processes cryptographic objects) processes the malicious file, the OpenSSL buffer overflow is triggered, allowing code execution on the controller.
Prerequisites
  • Network or local access to CEPE device firmware upload interface
  • Logged-in user account with high privileges on the CEPE system, OR the device configured to automatically process uploaded cryptographic objects
  • Ability to craft or deliver malicious firmware, PKCS#12 certificate, or CMS/PKCS#7 signed object to the target system
remotely exploitablehigh CVSS score (9.8)high EPSS score (52.4%)affects manufacturing control systemsbuffer overflow can lead to arbitrary code executionrequires authentication or special file format but no user interaction for auto-processing
Exploitability
Likely to be exploited — EPSS score 55.9%
Public Proof-of-Concept (PoC) on GitHub (6 repositories)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
CEPE ProductFesto AX OS 25.0.1.46Fix available
CEPE ProductFesto AX OS 25.9.2.4Fix available
Remediation & Mitigation
0/5
Do now
0/2
WORKAROUNDRestrict network access to CEPE firmware upload and certificate management interfaces to authorized engineering workstations only using firewall rules
HARDENINGDisable or restrict automatic processing of uploaded firmware files and cryptographic objects if the feature is not required for normal operations
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Festo AX OS from version 25.0.1.46 or 25.9.2.4 to version 26.3.1.4 or later
HARDENINGRequire multi-factor authentication or additional approval workflow for any firmware uploads and certificate installations on CEPE systems
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate CEPE systems from general corporate networks and untrusted file sources
View full CERT@VDE advisory
API: /api/v1/advisories/837a2d6b-7dc4-4874-aae4-35a944eda6fd

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.