HOMEVULNERABILITIESCVE-2014-0769
CRITICAL

CVE-2014-0769

CWE-287Published: April 25, 2014· Updated: Jun 17, 2026

9.3
CVSS v3.1

Official Description

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001.

NVD Source

Technical Analysis

CVE-2014-0769 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityM
Privileges Req.
User Interaction
Scope
Impact
ConfidentialityC
IntegrityC
AvailabilityC
AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected Vendors & Products

3s-software1 product(s)
codesys runtime system
festo2 product(s)
cecx-x-m1 modular controllercecx-x-c1 modular master controller
softmotion3d1 product(s)
softmotion
Source: NVD CPE · 4 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
External links open in a new tab. Always verify in a controlled environment before use.

All References (2)

Quick Facts

CVE IDCVE-2014-0769
CVSS Score9.3 / 10
SeverityCRITICAL
WeaknessCWE-287
CISA KEVNo
Affected3 vendor(s)
PublishedApr 25, 2014

Related CVEs (CWE-287)

Recommended Actions

  • Apply vendor patches immediately
  • Monitor CVE-2014-0769 in threat intel feeds
  • Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.