CVE-2020-2760 Festo Didactic SE CVE debrief

Who should care

Operators and administrators responsible for Festo MES PC deployments, especially where the bundled or underlying software stack includes MySQL Server components; defenders should also care if their environment depends on the affected MySQL versions or related replacement software referenced by the advisory.

Technical summary

The supplied record gives CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H (score 5.5, Medium). The attack requires high privileges and network access, and the source says multiple protocols may be used. Successful exploitation can result in a hang or frequently repeatable crash of MySQL Server, and can also permit unauthorized insert, update, or delete actions against some accessible data. The advisory text cites affected Oracle MySQL Server versions 5.7.29 and prior, and 8.0.19 and prior.

Defensive priority

Medium. This is not marked as a CISA KEV item in the supplied data, but it can still affect availability and data integrity. Prioritize if the affected MySQL component is present in a production MES PC deployment or any service with high-privilege network access paths.

Recommended defensive actions

• Verify whether the deployed MES PC stack contains the affected MySQL Server/InnoDB component and whether the listed versions are present.
• Follow the vendor advisory and obtain the current Factory Control Panel version referenced as the replacement for XAMPP on MES PCs.
• Use the official Festo support contact named in the advisory to confirm the applicable fixed release and upgrade path.
• Restrict and review high-privilege network access to the affected service paths, since the source says exploitation requires high privileges and network access.
• Monitor for repeatable crashes, hangs, or unexpected data modification symptoms on affected systems.
• Track the CISA and vendor advisory references for any scope clarifications or updated remediation guidance.

Evidence notes

The source item is a CISA CSAF republication of a Festo Didactic SE advisory. The vulnerability description in the corpus explicitly references Oracle MySQL Server/InnoDB and affected versions 5.7.29 and prior and 8.0.19 and prior. The remediation section states that Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs and directs customers to technical support for the current version. The record was initially published on 2024-02-27 and later republished by CISA on 2026-01-27. No KEV enrichment is present in the supplied data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.