Festo Compact Vision System, Control Block, Controller, and Operator Unit products

CISA advisory for critical vulnerabilities in Festo Compact Vision System, Control Block, Controller, and Operator Unit products. CVE-2022-22515 allows authenticated attackers to read/modify configuration files via CODESYS Control runtime. CVE-2022-31806 involves insecure default initialization with no password protection enabled by default in CODESYS V2. Both vulnerabilities are remotely exploitable with low attack complexity. All versions of affected Festo products are vulnerable. Mitigations include enabling password protection and using online user management.