Medium Check your exposure
OpenSSL flaws affect Festo AX OS in the CEPE product
CERT@VDE advisoriesFesto, Phoenix Contact, OpenSSLCVE-2025-15467, CVE-2025-69419
What happened. Festo AX OS versions 25.0.1.46 and 25.9.2.4, used by the Festo CEPE and based on PLCnext, are affected by two OpenSSL flaws. Attacks involve crafted firmware, key files or signed objects. They typically need a high-privilege user.
Who is affected. Festo AX OS versions 25.0.1.46 and 25.9.2.4 used by the Festo CEPE, which is based on PLCnext by Phoenix Contact.
What to do. Check whether you run Festo AX OS 25.0.1.46 or 25.9.2.4 in a CEPE, and follow the Festo advisory FSA-202602.
Editor's reading
Forasset ownervendor/integrator
- Purdue level
- L1
Why: Festo AX OS on the CEPE is PLCnext-based device firmware, which sits at the controller level (L1).
- Are you exposed?
Check the asset inventory for Festo CEPE units running AX OS 25.0.1.46 or 25.9.2.4.
- If you cannot fix it yet
- Restrict logons and file uploads on the device to a small set of trusted administrators.
- Accept firmware, key or certificate files only from trusted sources.
- Watch for
- Uploads of firmware, key, PKCS#12 or signed files to the device from unexpected users or hosts.
- Logons with high-privilege accounts on the device outside normal maintenance.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.