CVE-2019-11045 Festo Didactic SE CVE debrief

Who should care

Festo Didactic SE MES PC operators, OT/ICS administrators, application owners who rely on PHP path validation, and security teams responsible for systems using bundled PHP/XAMPP components. Pay particular attention to environments where MES PC handles sensitive local files or is exposed to network-facing requests.

Technical summary

The vulnerability is a PHP DirectoryIterator path-handling flaw: filenames with an embedded NUL byte may be interpreted as terminating early. If software checks a path first and then performs file access based on the truncated value, an attacker can potentially bypass intended file-scope restrictions. The supplied advisory links this CVE to Festo MES PC and recommends moving from XAMPP to Factory Control Panel.

Defensive priority

Medium priority, with higher urgency on any MES PC deployment that depends on PHP for file/path authorization or stores sensitive operational data. CVSS 5.9 reflects network reachability but high attack complexity and confidentiality impact rather than direct integrity or availability loss.

Recommended defensive actions

• Identify all Festo MES PC installations and confirm whether they use the affected XAMPP/PHP stack referenced in the advisory.
• Obtain and deploy the current Factory Control Panel version from Festo support, as referenced in the remediation guidance.
• Review any application logic that validates file paths before reading or listing files, especially code using PHP DirectoryIterator.
• Restrict access to MES PC services and monitor for unexpected file enumeration or authorization failures.
• Verify upgrade status across similar PHP-based OT or utility applications that may reuse the same path-checking pattern.

Evidence notes

The source advisory for Festo Didactic SE MES PC states that PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 accept filenames with embedded NUL bytes in DirectoryIterator and may mishandle them as terminators. The same source recommends Factory Control Panel as a replacement for XAMPP on MES PCs and provides Festo/CERT references for the advisory. No KEV listing was provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.