Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions

Festo MSE6 devices have hidden test functions that aren't documented in the user manual. An attacker with basic access to the device remotely could exploit these functions to completely compromise the system's security, stealing data, modifying it, or shutting it down.

The MSE6 product family contains undocumented remote-accessible test mode functions that can be invoked by a low-privileged authenticated attacker. Exploitation requires network access to the device and valid credentials; successful exploitation results in complete compromise of confidentiality, integrity, and availability (CIA triad).