CVE-2014-0760: The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and

This month

HIGH 9.3MITIGATEMITIGATEMITIGATE

CVE-2014-0760 is a high-severity flaw (CVSS 9.3) affecting codesys runtime system, cecx-x-c1 modular master controller, softmotion. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.

Why this priority

Critical severity

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	9.3 (High)
EPSS exploit chance	3.3% (top 11%)
CISA exploited list	No
Weakness	CWE-287
Published	2014-04-25
Last modified	2026-06-17

Publisher (CNA): ICS-CERT · Vendor: 3s-software · festo · softmotion3d

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2014-04-25 05:12 UTCPublished CVE record published
2026-06-17 00:03 UTCUpdated Record last modified

3s-software codesys runtime system MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy codesys-runtime-system || rpm -q codesys-runtime-system || codesys-runtime-system --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

festo cecx-x-c1 modular master controller MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

Firmware

Install the latest firmware from the vendor advisory; if none, apply the vendor workaround.

softmotion3d softmotion MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy softmotion || rpm -q softmotion || softmotion --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

festo cecx-x-m1 modular controller MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

Firmware

Install the latest firmware from the vendor advisory; if none, apply the vendor workaround.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2014-0760?

codesys runtime system: mitigate or apply the listed mitigation; cecx-x-c1 modular master controller: mitigate or apply the listed mitigation; softmotion: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2014-0760 being exploited?

CVE-2014-0760 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2014-0760 affect?

CVE-2014-0760 affects codesys runtime system, cecx-x-c1 modular master controller, softmotion. Severity is high (CVSS 9.3). The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which could allow a remote attacker to execute arbit

How urgent is CVE-2014-0760?

Priority 55/100. Critical severity

Related CVEs

CVE-2018-5440 CRITICAL 9.8 UPGRADE DOWNGRADE A Stack-based Buffer Overflow issue was discovered in 3S-Smart CODESYS Web Server
CVE-2015-6482 MEDIUM 5.0 UPGRADE Runtime Toolkit before 2.4.7.48 in 3S-Smart CODESYS before 2.3.9.48 allows remote attackers to cause a denial
CVE-2014-0769 HIGH 9.3 MITIGATE MITIGATE The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and S
CVE-2012-6069 CRITICAL 10.0 DOWNGRADE The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an
CVE-2012-6068 CRITICAL 9.8 DOWNGRADE The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows re

References

← Back to latest CVEs