Cyber Resilience

CVE-2023-3634

High

Published: 16 April 2026

Published
16 April 2026
Modified
17 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0050 39.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2023-3634 is a high-severity Inclusion of Undocumented Features or Chicken Bits (CWE-1242) vulnerability in Certvde (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2023-3634 is a vulnerability in products of the MSE6 product-family by Festo. It stems from the exposure of functions in an undocumented test mode, which a remote authenticated low-privileged attacker could abuse. This issue, published on 2026-04-16, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-1242.

The attack scenario involves a remote attacker who has obtained low-privilege authentication to the affected product. By leveraging the undocumented test mode functions, the attacker can achieve a complete loss of confidentiality, integrity, and availability, enabling full compromise of the targeted system.

Advisories detailing mitigations and patches are available from CERT VDE at https://certvde.com/de/advisories/VDE-2023-020/ and Festo's CSAF document at https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2023/fsa-202304.json.

EU & UK References

Vulnerability details

In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.

CWE(s)
CWE-1242

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Vulnerability enables low-privileged remote authenticated attacker to exploit undocumented test mode functions, achieving full system compromise (C/I/A), directly facilitating Exploitation for Privilege Escalation (T1068) and Exploitation of Remote Services (T1210).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-41756Shared CWE-1242

Affected Assets

Certvde
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-6 Least Privilege good match
prevent

Least privilege prevents low-privileged authenticated users from accessing undocumented test mode functions that enable full compromise of confidentiality, integrity, and availability.

CM-7 Least Functionality good match
prevent

Least functionality prohibits or restricts unnecessary undocumented test mode features in production systems, eliminating the exploitable surface for attackers.

AC-3 Access Enforcement good match
prevent

Access enforcement mechanisms block low-privileged remote attackers from invoking high-impact test mode functions that lead to complete system compromise.

References