CVE-2013-6501 Festo Didactic SE CVE debrief

Who should care

Administrators and operators responsible for Festo Didactic SE MES PC deployments, plus teams maintaining PHP installations that still rely on php.ini-production or php.ini-development defaults. Systems that allow local user access on the host are especially relevant.

Technical summary

The vulnerable default places SOAP WSDL cache files in /tmp, a shared location. The advisory states that a local user can create a file with a predictable name that is later used by get_sdl in ext/soap/php_sdl.c, enabling WSDL injection. The source corpus assigns CVSS 3.0 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact despite the local-user prerequisite.

Defensive priority

High — prioritize if the affected MES PC or PHP host is in active use, allows local logins, or still relies on the default SOAP cache path.

Recommended defensive actions

• Replace the vulnerable MES PC component with the vendor-provided Factory Control Panel version referenced in the advisory.
• Review PHP hosts for soap.wsdl_cache_dir settings and move SOAP cache storage away from /tmp to a restricted directory.
• Restrict unnecessary local user access on affected hosts and apply least-privilege controls to cache and runtime directories.
• After remediation, restart the vulnerable component as required and verify the new configuration is in effect.
• Use CISA ICS defensive guidance and hardening practices to reduce the risk of local tampering on shared systems.

Evidence notes

The CISA CSAF source item (ICSA-26-027-02) republished the Festo advisory for MES PC and includes the CVE-2013-6501 description stating that php.ini-production and php.ini-development default soap.wsdl_cache_dir to /tmp, enabling local users to conduct WSDL injection attacks via predictable filenames used by get_sdl. The advisory also lists a vendor remediation: Factory Control Panel as a replacement for XAMPP on MES PCs, with a remediation date of 2023-05-26 in the source corpus. The provided record is published on 2024-02-27 and modified on 2026-01-27; no KEV entry or ransomware linkage is present in the supplied data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.