CVE-2023-3634
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2023-3634 is a high-severity Inclusion of Undocumented Features or Chicken Bits (CWE-1242) vulnerability in Certvde (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-3634 is a vulnerability in products of the MSE6 product-family by Festo. It stems from the exposure of functions in an undocumented test mode, which a remote authenticated low-privileged attacker could abuse. This issue, published on 2026-04-16, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-1242.
The attack scenario involves a remote attacker who has obtained low-privilege authentication to the affected product. By leveraging the undocumented test mode functions, the attacker can achieve a complete loss of confidentiality, integrity, and availability, enabling full compromise of the targeted system.
Advisories detailing mitigations and patches are available from CERT VDE at https://certvde.com/de/advisories/VDE-2023-020/ and Festo's CSAF document at https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2023/fsa-202304.json.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-44280
Vulnerability Data
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.3.4
Mitigating Controls (NIST 800-53 r5) AI
Least-functionality configuration can disable or remove non-essential capabilities once discovered, limiting the blast radius of any undocumented chicken bits that remain.
Documented development standards and processes directly require that all device features be specified and recorded, preventing hidden chicken bits from being introduced.
An SDLC that incorporates security requires all features to be captured in requirements and design artifacts, stopping undocumented capabilities from being added.
Security engineering principles applied during design explicitly call for complete, documented functionality and the avoidance of hidden or undeclared mechanisms.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can uncover undocumented functionality before release.
Secure development life cycle requires documented design and review, reducing hidden or undocumented features.
Secure system architecture and engineering principles mandate documented, minimal, and auditable designs, limiting chicken bits.
Secure coding standards and peer review detect and prohibit undocumented or debug features.
Change management processes require documented approvals, reducing the chance of hidden features being introduced.
Configuration management enforces documented, approved configurations, limiting undocumented hardware or firmware features.