CVE-2023-0662 Festo Didactic SE CVE debrief

Who should care

Administrators and operators running PHP 8.0.x before 8.0.28, 8.1.x before 8.1.16, or 8.2.x before 8.2.3 should prioritize this, especially if the affected PHP stack is part of a Festo MES PC deployment or another externally reachable service.

Technical summary

The vulnerability is a resource-exhaustion issue in PHP's handling of HTTP form uploads with an excessive number of parts. According to the supplied advisory text, the behavior can cause high CPU usage and excessive log entries, which may lead to denial of service by exhausting CPU resources or disk space. The affected version boundaries listed in the source are PHP 8.0.x before 8.0.28, 8.1.x before 8.1.16, and 8.2.x before 8.2.3.

Defensive priority

High for exposed PHP services and operational environments that depend on the affected PHP versions; prioritize patching or vendor-supported replacement in MES PC deployments.

Recommended defensive actions

• Upgrade PHP to 8.0.28, 8.1.16, or 8.2.3, or later, as applicable to your deployment.
• If you are using the Festo MES PC stack, obtain and deploy the current Factory Control Panel version through Festo support as described in the advisory.
• Review HTTP form upload handling, request limits, and log retention so repeated high-volume uploads cannot exhaust CPU or disk space.
• Monitor affected systems for abnormal log growth, upload anomalies, and resource spikes until remediation is complete.
• Follow CISA ICS recommended practices to reduce exposure and improve resilience around operational systems.

Evidence notes

Primary evidence comes from the supplied CISA CSAF source advisory and the linked official records. The source text states that excessive HTTP form upload parts can cause high resource consumption and excessive log entries, leading to denial of service by exhausting CPU resources or disk space. The advisory metadata identifies the vendor context as Festo Didactic SE / MES PC and lists a vendor remediation dated 2023-05-26, while the CVE and source record were published on 2024-02-27 and later republished/revised on 2026-01-27. No exploit code or unsupported impact claims are included.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.