PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-7068 Festo Didactic SE CVE debrief

CVE-2020-7068 describes a use-after-free in PHP's phar extension when parsing PHAR ZIP files. In the supplied Festo MES PC advisory context, the practical concern is exposure on systems still running the affected PHP/XAMPP stack. The issue is low severity overall, but it can still cause a crash or limited information disclosure, so affected deployments should move to the vendor-recommended replacement software and verify the vulnerable component is no longer present.

Vendor
Festo Didactic SE
Product
MES PC
CVSS
LOW 3.6
CISA KEV
Not listed in stored evidence
Original CVE published
2024-02-27
Original CVE updated
2026-01-27
Advisory published
2024-02-27
Advisory updated
2026-01-27

Who should care

Festo Didactic MES PC operators, OT/IT administrators, and anyone maintaining PHP/XAMPP-based components on those systems. Security teams should also care if local users can interact with PHP tooling or PHAR-processing paths.

Technical summary

The vulnerability affects PHP 7.2.x before 7.2.33, 7.3.x before 7.3.21, and 7.4.x before 7.4.9. While processing PHAR files through the phar extension, phar_parse_zipfile could be induced to access freed memory, matching CWE-416 (use-after-free). The supplied CVSS vector is AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L, which aligns with a local, high-complexity issue that may lead to process instability or limited memory disclosure rather than code execution.

Defensive priority

Low to moderate. Prioritize remediation if MES PCs still include the affected PHP/XAMPP stack; otherwise treat as routine maintenance. The issue is not listed as KEV in the provided enrichment and has a low CVSS score, but it still warrants removal of the vulnerable component.

Recommended defensive actions

  • Replace the vulnerable stack with the vendor-recommended Factory Control Panel for MES PCs, as stated in the advisory.
  • Confirm the affected PHP versions are no longer installed or reachable on the MES PC environment.
  • If any PHP-based tooling must remain, verify it is upgraded beyond 7.2.33, 7.3.21, or 7.4.9 as applicable.
  • Check for any PHAR-processing paths that could still trigger the vulnerable code and remove or disable them where possible.
  • Plan and verify any required restart of the vulnerable component or system after replacement.
  • Use the official Festo technical support channel to obtain the current fixed version referenced in the advisory.

Evidence notes

The supplied CISA CSAF source item (ICSA-26-027-02) republishes the Festo advisory and ties CVE-2020-7068 to Festo Didactic SE MES PC. It states that PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21, and 7.4.x below 7.4.9 are affected when phar_parse_zipfile processes PHAR files via the phar extension, resulting in freed-memory access that can crash the process or disclose information. The remediation section says Festo Didactic released Factory Control Panel as a replacement for XAMPP on MES PCs. The CVE was published on 2024-02-27; the supplied source item was republished by CISA on 2026-01-27.

Official resources

CVE-2020-7068 was published on 2024-02-27. The supplied CISA source item was republished on 2026-01-27, so that later date should be treated as advisory republication context, not the CVE issue date. No KEV entry was supplied in the prompt.