PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-0567 Festo Didactic SE CVE debrief

CVE-2023-0567 describes a PHP password verification weakness that can matter in Festo Didactic SE MES PC deployments when affected PHP versions and malformed Blowfish hashes are present. In PHP 8.0.x before 8.0.28, 8.1.x before 8.1.16, and 8.2.x before 8.2.3, password_verify() may accept some invalid Blowfish hashes as valid. If one of those invalid hashes is stored in a password database, an application may treat any password as correct for that account.

Vendor
Festo Didactic SE
Product
MES PC
CVSS
MEDIUM 6.2
CISA KEV
Not listed in stored evidence
Original CVE published
2024-02-27
Original CVE updated
2026-01-27
Advisory published
2024-02-27
Advisory updated
2026-01-27

Who should care

Operators and administrators responsible for Festo Didactic SE MES PC systems, especially environments using the affected Factory Control Panel/XAMPP stack or any deployment that relies on the vulnerable PHP versions for authentication.

Technical summary

The underlying issue is in PHP’s password_verify() handling of certain malformed Blowfish hashes. When an invalid hash is present in a password database, the function may return success in cases where it should reject the hash. The practical effect is authentication bypass for the affected account if such a hash exists. The advisory references PHP fixes for 8.0.28, 8.1.16, and 8.2.3.

Defensive priority

Medium. The flaw is conditional on a malformed hash already being present, but the impact can be severe for affected accounts because it may allow unintended authentication success.

Recommended defensive actions

  • Obtain the current Factory Control Panel version from Festo technical support and deploy the vendor-fixed release referenced in the advisory.
  • Confirm that all deployed PHP instances are at or above 8.0.28, 8.1.16, or 8.2.3, as applicable.
  • Review password databases for any malformed or unexpected Blowfish hashes and reset or rehash affected credentials.
  • Audit authentication logs for unusual successful logins tied to accounts that may have stored legacy hashes.
  • Follow CISA and vendor guidance for industrial control system hardening and defense-in-depth practices.

Evidence notes

This debrief is based on the CISA CSAF republication for Festo Didactic SE MES PC (ICSA-26-027-02) and its linked vendor references. The source description explicitly states the PHP password_verify() issue and affected versions. The remediation entry states that Festo released Factory Control Panel as a replacement for XAMPP on MES PCs and that the current version includes fixes. Timing context follows the CVE published date provided in the corpus (2024-02-27), while the 2026-01-27 CISA republication is treated only as a later advisory update.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-0567 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-0567

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-0567 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-0567

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-027-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2024/fsa-202402.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/vendor/festo/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://festo.com/psirt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/VDE-2023-065

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-027-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.