Cyber Posture

CVE-2023-3634

High

Published: 16 April 2026

Published
16 April 2026
Modified
17 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0010 27.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.

Mitigating Controls (NIST 800-53 r5)AI

AC-6 Least Privilege good match
prevent

Least privilege prevents low-privileged authenticated users from accessing undocumented test mode functions that enable full compromise of confidentiality, integrity, and availability.

CM-7 Least Functionality good match
prevent

Least functionality prohibits or restricts unnecessary undocumented test mode features in production systems, eliminating the exploitable surface for attackers.

AC-3 Access Enforcement good match
prevent

Access enforcement mechanisms block low-privileged remote attackers from invoking high-impact test mode functions that lead to complete system compromise.

Security SummaryAI

CVE-2023-3634 is a vulnerability in products of the MSE6 product-family by Festo. It stems from the exposure of functions in an undocumented test mode, which a remote authenticated low-privileged attacker could abuse. This issue, published on 2026-04-16, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-1242.

The attack scenario involves a remote attacker who has obtained low-privilege authentication to the affected product. By leveraging the undocumented test mode functions, the attacker can achieve a complete loss of confidentiality, integrity, and availability, enabling full compromise of the targeted system.

Advisories detailing mitigations and patches are available from CERT VDE at https://certvde.com/de/advisories/VDE-2023-020/ and Festo's CSAF document at https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2023/fsa-202304.json.

Details

CWE(s)
CWE-1242

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Vulnerability enables low-privileged remote authenticated attacker to exploit undocumented test mode functions, achieving full system compromise (C/I/A), directly facilitating Exploitation for Privilege Escalation (T1068) and Exploitation of Remote Services (T1210).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References