PatchSiren cyber security CVE debrief

CVE-2020-2922 Festo Didactic SE CVE debrief

CVE-2020-2922 is a low-severity information disclosure issue affecting Oracle MySQL Client C API as described in the supplied advisory corpus. The advisory text says an unauthenticated network attacker using multiple protocols could compromise the client and read a subset of accessible data. In the CISA CSAF republish, the advisory is presented in a Festo Didactic SE MES PC context, with vendor remediation pointing to Factory Control Panel as a replacement for XAMPP on MES PCs. For defenders, the main takeaway is exposure management rather than emergency incident response: the CVSS score is 3.7 (LOW), the impact is confidentiality-only, and the source material indicates a vendor replacement/fix path is available. Because the supplied corpus ties the advisory to Festo MES PC while the vulnerability description references Oracle MySQL Client, treat the product mapping carefully and verify which deployed component is actually present before planning remediation.

Vendor: Festo Didactic SE
Product: MES PC
CVSS: LOW 3.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-02-27
Original CVE updated: 2026-01-27
Advisory published: 2024-02-27
Advisory updated: 2026-01-27

Who should care

Operators and maintainers of Festo Didactic SE MES PC deployments, especially environments that include Oracle MySQL Client/C API components or bundled XAMPP-related tooling. Security teams responsible for industrial/OT workstation hardening and software inventory should also review exposure.

Technical summary

The supplied CVE text describes a network-accessible MySQL Client C API issue with high attack complexity, no privileges required, and no user interaction. If exploited, the attacker can obtain unauthorized read access to a limited subset of client-accessible data. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, matching a low confidentiality impact with no integrity or availability impact. The CISA CSAF record republishes the advisory under Festo Didactic SE MES PC and links remediation to Factory Control Panel as a replacement for XAMPP on MES PCs.

Defensive priority

Low-to-moderate operational priority. The issue is low severity, but it is network-reachable and unauthenticated, so exposed instances should still be inventoried and remediated where the affected client component is present.

Recommended defensive actions

Identify whether MES PC systems include the affected Oracle MySQL Client/C API component or related XAMPP tooling.
Review the Festo advisory and vendor references to confirm the applicable fixed or replacement version for your deployment.
Obtain the current Factory Control Panel release from Festo technical support if your environment uses the MES PC software path described in the advisory.
Restrict unnecessary network exposure around affected systems and segment OT/industrial workstations where feasible.
Validate that any remediation preserves required MES PC functionality before rollout.
Track asset inventory for the specific MES PC build and document whether the vulnerable component is present or absent.

Evidence notes

The supplied corpus gives the CVE publishedAt as 2024-02-27T12:00:00Z and modifiedAt as 2026-01-27T16:20:28.099Z. The advisory text states affected Oracle MySQL versions 5.6.47 and prior, 5.7.29 and prior, and 8.0.18 and prior, with unauthorized read access as the impact. CISA’s CSAF metadata republishes the issue under Festo Didactic SE MES PC, and the remediation entry says Factory Control Panel replaced XAMPP on MES PCs. The remediation date in the source corpus (2023-05-26) predates the CVE publication timestamp, so it should be treated as vendor fix availability context rather than the disclosure date. The corpus also contains a possible product/vulnerability-description mismatch; the advisory text should be verified against the deployed software stack.

Official resources

This debrief is based only on the supplied source corpus and official links. It describes a low-severity, network-reachable confidentiality issue and includes a noted source-corpus mismatch between the Oracle MySQL Client description and F