What is the CVSS score of CVE-2023-3526?

CVE-2023-3526 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Cloud Client 1101T Tx Firmware CVE-2023-3526

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2023-08-08 info@cert.vde.com

XSS Cloud Client 1101T Tx Firmware Tc Cloud Client 1002 4G Att Firmware Tc Cloud Client 1002 4G Firmware Tc Cloud Client 1002 4G Vzw Firmware Tc Router 3002T 4G Att Firmware Tc Router 3002T 4G Firmware Tc Router 3002T 4G Vzw Firmware

9.6

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Aug 08, 2023 - 07:15 cve.org

CRITICAL 9.6

DescriptionCVE.org

In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser.

AnalysisAI

In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser. Affected products include: Phoenixcontact Cloud Client 1101T-Tx Firmware, Phoenixcontact Tc Cloud Client 1002-4G Att Firmware, Phoenixcontact Tc Cloud Client 1002-4G Firmware, Phoenixcontact Tc Cloud Client 1002-4G Vzw Firmware, Phoenixcontact Tc Router 3002T-4G Att Firmware. Version information: prior to 2.07.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.