PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-7063 Festo Didactic SE CVE debrief

CISA’s Festo Didactic SE MES PC advisory includes CVE-2020-7063, a PHP PHAR archive permission issue that can preserve files at a default 0666 permission level when using PharData::buildFromIterator(). For MES PC environments that still rely on affected PHP builds, extracted files may end up with broader access than intended, which is a hardening and integrity concern. The advisory points to Factory Control Panel as the replacement for XAMPP on MES PCs and states that current versions include fixes.

Vendor
Festo Didactic SE
Product
MES PC
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2024-02-27
Original CVE updated
2026-01-27
Advisory published
2024-02-27
Advisory updated
2026-01-27

Who should care

Operators and maintainers of Festo Didactic SE MES PC systems, especially teams still using XAMPP or affected PHP builds, and administrators responsible for archive creation/extraction workflows and post-extraction file permissions.

Technical summary

The underlying issue affects PHP 7.2.x below 7.2.28, 7.3.x below 7.3.15, and 7.4.x below 7.4.3. When creating a PHAR archive with PharData::buildFromIterator(), files can be added with default permissions (0666) even if the source files are more restrictive, so extracted content may have weaker-than-intended permissions. The supplied advisory data assigns CVSS 3.1 5.3/Medium with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Defensive priority

Medium — prioritize if MES PC deployments still generate or extract PHAR archives with affected PHP versions; otherwise verify the vendor replacement and plan remediation during normal maintenance.

Recommended defensive actions

  • Confirm whether any MES PC systems still use PHP 7.2 < 7.2.28, 7.3 < 7.3.15, or 7.4 < 7.4.3 and inventory any PHAR archive workflows.
  • Adopt Festo’s current Factory Control Panel version for MES PCs, obtained via the vendor support path cited in the advisory, as the documented replacement for XAMPP.
  • Review archive creation and extraction steps to ensure file permissions are checked after extraction and tightened where required.
  • Restrict access to archive destinations and monitor for unexpected permission broadening on extracted files.
  • Validate the vendor-provided replacement or update in a test environment before rolling it into production MES PC systems.

Evidence notes

The source corpus ties CVE-2020-7063 to CISA CSAF advisory ICSA-26-027-02 for Festo Didactic SE MES PC and republishes the underlying Festo advisory information. The published CVE date supplied is 2024-02-27, and the source was modified/republished on 2026-01-27; those dates describe the advisory record, not a separate vulnerability event. No KEV listing is provided in the supplied data.

Sources and references

Verified primary and authoritative sources

  • CVE-2020-7063 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2020-7063

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2020-7063 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2020-7063

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-027-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2024/fsa-202402.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/vendor/festo/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://festo.com/psirt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/VDE-2023-065

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-027-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.