CVE-2019-9637 Festo Didactic SE CVE debrief

Who should care

Administrators and operators running affected PHP versions, especially in environments where sensitive files are moved across filesystems. Festo Didactic SE MES PC users should pay close attention to the vendor advisory and remediation guidance.

Technical summary

The flaw affects PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. According to the advisory text, rename() across filesystems can leave a file briefly exposed with incorrect permissions during the rename operation. That transient permission window can allow unauthorized users to access the data. The supplied advisory record associates the CVE with Festo Didactic SE MES PC and provides a vendor remediation path via Factory Control Panel as a replacement for XAMPP on MES PCs. The recorded CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5, High).

Defensive priority

High — the issue is a straightforward confidentiality exposure with no integrity or availability impact in the provided vector, but it can expose sensitive data during routine file handling.

Recommended defensive actions

• Upgrade PHP to a fixed release: 7.1.27 or later, 7.2.16 or later, or 7.3.3 or later.
• If you operate Festo Didactic SE MES PC, follow the vendor guidance to obtain the current Factory Control Panel version that includes fixes; the advisory directs customers to [email protected].
• Review applications and workflows that move sensitive files across filesystems, since that is the condition that creates the permission window.
• Verify file-permission handling in related deployment and update workflows so sensitive data is not exposed during rename operations.
• Use the CISA and vendor advisory links to confirm product applicability before scheduling changes.

Evidence notes

The vulnerability description, fixed PHP version ranges, and CVSS vector come from the supplied CISA CSAF record and the referenced CVE metadata. The Festo Didactic SE MES PC product mapping and the Factory Control Panel remediation path are taken from the same advisory metadata. The supplied timeline shows the advisory record published on 2024-02-27 and republished on 2026-01-27; those dates are advisory-record timing, not the original flaw date.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.