PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-11034 Festo Didactic SE CVE debrief

CVE-2019-11034 is a critical buffer over-read in the PHP EXIF extension’s exif_process_IFD_TAG function. In the supplied CISA CSAF advisory for Festo Didactic SE MES PC, the issue is described as affecting PHP 7.1.x below 7.1.28, 7.2.x below 7.2.17, and 7.3.x below 7.3.4, with possible outcomes of information disclosure or a crash. The vendor remediation points to replacing XAMPP on MES PCs with Factory Control Panel, which the advisory says includes fixes for these vulnerabilities.

Vendor
Festo Didactic SE
Product
MES PC
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-02-27
Original CVE updated
2026-01-27
Advisory published
2024-02-27
Advisory updated
2026-01-27

Who should care

OT/ICS administrators, MES PC operators, and support teams responsible for Festo Didactic SE systems that include PHP EXIF-capable components should treat this as urgent, especially if any deployment still uses the affected PHP versions listed in the advisory.

Technical summary

The vulnerability is a memory-safety issue in the PHP EXIF extension: when processing certain files, exif_process_IFD_TAG can read past the allocated buffer. The CVSS 3.1 vector provided in the source is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H (9.1 Critical), indicating potential remote impact with no privileges or user interaction required per the scoring. The CISA advisory ties the issue to Festo Didactic SE MES PC and recommends moving to Factory Control Panel as the fixed replacement for XAMPP.

Defensive priority

Urgent. The combination of a critical score, potential information disclosure, and crash/availability impact justifies immediate inventory, version verification, and remediation planning for any affected MES PC deployment.

Recommended defensive actions

  • Inventory Festo Didactic SE MES PC deployments and confirm whether they include the affected PHP EXIF versions or bundled components.
  • Replace XAMPP on MES PCs with the vendor-recommended Factory Control Panel version referenced in the advisory.
  • Contact Festo technical support at [email protected] to obtain the current fixed version.
  • If immediate replacement is not possible, limit exposure of systems processing untrusted files and apply compensating network controls consistent with ICS defense-in-depth guidance.
  • Verify service downtime and restart needs for the vulnerable component before scheduling remediation.
  • Review logs and operational procedures for any unexpected crashes or data exposure symptoms in affected environments.

Evidence notes

All claims here are limited to the supplied CISA CSAF source item and its listed references. The source explicitly states the PHP EXIF version ranges, the exif_process_IFD_TAG over-read condition, and the potential for information disclosure or crash. It also provides the Festo MES PC context and the Factory Control Panel remediation. No KEV listing or active exploitation evidence was supplied.

Official resources

Public disclosure in the supplied corpus is through CISA CSAF advisory ICSA-26-027-02, first published on 2024-02-27 and later republished on 2026-01-27 per the revision history. The advisory records the Festo Didactic SE MES PC context and