CVE-2013-6501 Festo Didactic SE CVE debrief

Who should care

Administrators and operators responsible for Festo Didactic SE MES PC deployments, plus teams maintaining PHP installations that still rely on php.ini-production or php.ini-development defaults. Systems that allow local user access on the host are especially relevant.

Technical summary

The vulnerable default places SOAP WSDL cache files in /tmp, a shared location. The advisory states that a local user can create a file with a predictable name that is later used by get_sdl in ext/soap/php_sdl.c, enabling WSDL injection. The source corpus assigns CVSS 3.0 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact despite the local-user prerequisite.

Defensive priority

High — prioritize if the affected MES PC or PHP host is in active use, allows local logins, or still relies on the default SOAP cache path.

Recommended defensive actions

• Replace the vulnerable MES PC component with the vendor-provided Factory Control Panel version referenced in the advisory.
• Review PHP hosts for soap.wsdl_cache_dir settings and move SOAP cache storage away from /tmp to a restricted directory.
• Restrict unnecessary local user access on affected hosts and apply least-privilege controls to cache and runtime directories.
• After remediation, restart the vulnerable component as required and verify the new configuration is in effect.
• Use CISA ICS defensive guidance and hardening practices to reduce the risk of local tampering on shared systems.

Evidence notes

The CISA CSAF source item (ICSA-26-027-02) republished the Festo advisory for MES PC and includes the CVE-2013-6501 description stating that php.ini-production and php.ini-development default soap.wsdl_cache_dir to /tmp, enabling local users to conduct WSDL injection attacks via predictable filenames used by get_sdl. The advisory also lists a vendor remediation: Factory Control Panel as a replacement for XAMPP on MES PCs, with a remediation date of 2023-05-26 in the source corpus. The provided record is published on 2024-02-27 and modified on 2026-01-27; no KEV entry or ransomware linkage is present in the supplied data.

Official resources