PatchSiren

PatchSiren cyber security CVE debrief

CVE-2014-9709 Festo Didactic SE CVE debrief

CVE-2014-9709 is a critical remote denial-of-service issue in GIF parsing code used by GD and PHP. In the supplied CISA CSAF advisory for Festo Didactic SE MES PC, a crafted GIF can be mishandled by gdImageCreateFromGif, leading to a buffer over-read and application crash. The vendor remediation points to Factory Control Panel as the replacement for XAMPP on MES PCs, indicating that the affected deployment context is the bundled web/application stack rather than the MES PC hardware itself.

Vendor
Festo Didactic SE
Product
MES PC
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-02-27
Original CVE updated
2026-01-27
Advisory published
2024-02-27
Advisory updated
2026-01-27

Who should care

Festo Didactic SE MES PC operators, OT and ICS administrators, and anyone responsible for the XAMPP/PHP/GD software stack on those systems should treat this as high priority. Systems that are reachable from untrusted networks or that process externally supplied images are the most important to review first.

Technical summary

The source corpus describes CVE-2014-9709 as a flaw in GetCode_ within gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5. A crafted GIF image processed through gdImageCreateFromGif can trigger a buffer over-read and crash. The supplied advisory maps this issue to Festo Didactic SE MES PC and assigns CVSS 3.0 9.1 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.

Defensive priority

High. The issue is network-reachable, requires no authentication or user interaction, and has a vendor-provided replacement path. Prioritize exposed or operationally important MES PC instances.

Recommended defensive actions

  • Inventory MES PC deployments and identify any systems still using the affected XAMPP/PHP/GD stack.
  • Obtain the current Factory Control Panel release from Festo technical support at [email protected] and apply the vendor-recommended replacement.
  • Plan maintenance for any required restart or service interruption, since the remediation notes a vulnerable component restart requirement.
  • Restrict network access to MES PC services that accept or process image content until the replacement is in place.
  • Review logs and crash reports for abnormal GIF handling or unexpected application failures on affected systems.

Evidence notes

The supplied source is CISA CSAF advisory ICSA-26-027-02, republishing the Festo advisory for MES PC and explicitly linking CVE-2014-9709 to the product. The remediation text states that Factory Control Panel replaces XAMPP on MES PCs and includes fixes for these vulnerabilities. Official record links are present for CVE.org and NVD, and the source references include the vendor CSAF, CISA advisory page, and Festo PSIRT page. The timeline fields supplied here place the CVE publication context at 2024-02-27 and the CISA republication at 2026-01-27; no KEV entry is listed in the supplied data.

Sources and references

Verified primary and authoritative sources

  • CVE-2014-9709 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2014-9709

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2014-9709 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2014-9709

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-027-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2024/fsa-202402.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/vendor/festo/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://festo.com/psirt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/VDE-2023-065

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-027-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.