Phoenixcontact
Monthly
Reflected cross-site scripting in the pxc_portSfp.php page of the web-based management (WBM) interface on Phoenix Contact FL Switch and FL NAT industrial Ethernet devices allows an unauthenticated remote attacker to craft a link that, when clicked by an already-authenticated WBM user, executes script in that user's browser context and alters device configuration parameters exposed by the web application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attacker needs no credentials but does require victim interaction; impact is capped at web-app configuration values, with no access to operating system internals or privileged functions, and the httpOnly session cookie prevents session hijacking. EPSS is 9.77% (95th percentile), indicating elevated short-term exploitation likelihood relative to typical XSS issues, though no public exploit code and no CISA KEV listing were identified at time of analysis.
Reflected cross-site scripting (XSS) in the pxc_portCntr.php endpoint of Phoenix Contact FL SWITCH and FL NAT industrial Ethernet switch firmware allows an unauthenticated remote attacker to socially engineer an operator who is actively logged into the device's web-based management (WBM) interface into clicking a crafted link; the injected script then executes in that authenticated session and can modify device configuration parameters exposed by the web application. CVSS:3.1 rates it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), with the scope change reflecting the crossed trust boundary between the attacker-supplied link and the operator's privileged WBM session, while the httpOnly session cookie flag prevents session hijacking and no operating-system-level or privileged functions are reachable. EPSS scores the flaw at 9.77% (95th percentile) likelihood of exploitation within 30 days, but there is no CISA KEV listing and no public exploit identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the pxc_PortCfg.php script of Phoenix Contact's web-based management (WBM) interface lets an unauthenticated remote attacker craft a link that, when clicked by an authenticated operator, silently modifies device configuration parameters exposed by the web application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attacker needs no credentials but does depend on victim user interaction, which is the primary limiting factor; EPSS is elevated at 9.77% (95th percentile), though no public exploit code and no CISA KEV listing were identified at time of analysis. Impact is bounded to WBM-scoped settings - the description explicitly rules out access to operating-system internals or privileged functions, and the httpOnly session cookie prevents session hijacking - so risk is genuine but LOW-to-MEDIUM and heavily dependent on whether the WBM interface is reachable and actively used by an operator.
Reflected cross-site scripting in port_util.php within the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT managed industrial Ethernet switches lets an unauthenticated remote attacker craft a link that, once clicked by an operator who is currently logged in to WBM, alters device-configuration parameters visible in the web application. The CVSS 3.1 base score of 7.1 is driven largely by the S:C scope change rather than by deep impact: confidentiality, integrity, and availability are each rated Low, the httpOnly session cookie prevents session hijacking, and the vendor states no access to operating-system internals or privileged functions is obtained. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.65% (49th percentile), so this is a genuine but modest-priority issue whose practical risk depends on whether the switch management plane is reachable from untrusted networks.
Cross-site scripting in the pxc_Dot1xCfg.php 802.1X configuration page of Phoenix Contact FL Switch and FL NAT industrial Ethernet switch firmware lets an unauthenticated remote attacker supply a crafted link that, when clicked by a user with an active web-based management (WBM) session, executes script in that user's browser and alters device configuration parameters reachable through the web application. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) confirms the attacker needs no authentication but does require victim interaction; impact is bounded to WBM-exposed settings, and the httpOnly session cookie prevents session hijacking. EPSS is 9.77% (95th percentile), indicating elevated predicted exploitation activity, but no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
Cross-site scripting in the Phoenix Contact FL SWITCH and FL NAT web-based management (WBM) interface - specifically the PHP script pxc_vlanIntfCfg.php - lets an unauthenticated remote attacker craft a malicious POST request that an already-authenticated operator is tricked into submitting, changing VLAN interface configuration parameters in that operator's WBM session. The attacker needs no credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) but must socially engineer a logged-in administrator into triggering the request, so exploitation depends on victim interaction and on the WBM interface being reachable on the network. Impact is deliberately bounded: the flaw reaches only web-application configuration parameters, not operating-system internals or privileged functions, and the httpOnly session cookie blocks session or credential theft; EPSS is elevated at 9.77% (95th percentile), but no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in the web-based management (WBM) interface of Phoenix Contact FL SWITCH industrial Ethernet switches - specifically the pxc_portSecCfg.php script - allows an unauthenticated remote attacker to craft malicious content that, once loaded by an authenticated WBM operator, submits a manipulated POST request and changes device configuration parameters exposed through the web application. User interaction by that authenticated operator is mandatory (UI:R), the session cookie is protected by the httpOnly flag so session hijacking is not achievable, and impact is confined to web-facing configuration settings rather than operating-system internals or privileged functions. EPSS is elevated at 9.77% (95th percentile) although no public exploit code has been identified at the time of analysis and the issue is not confirmed as actively exploited.
Cross-site scripting in the pxc_portCntr2.php endpoint of the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT industrial Ethernet switches allows an unauthenticated remote attacker (PR:N) to socially engineer a currently authenticated operator into submitting an attacker-crafted POST request that alters device configuration parameters exposed by the web application (CVSS 7.1, UI:R, scope changed). Impact is bounded: the vulnerability does not reach operating system internals or privileged functions, and the httpOnly session-cookie flag prevents the injected script from stealing or hijacking the authenticated session. EPSS is low (0.65%, ~49th percentile) and no public exploit or confirmed active exploitation was identified at time of analysis; success depends entirely on tricking an authenticated user into interacting with attacker-supplied content.
Successful exploitation of an undocumented UART port on the printed circuit board of Phoenix Contact FL Switch and FL NAT industrial Ethernet switches allows an attacker with physical access to obtain root-level control, particularly when combined with credentials harvested via CVE-2025-41692. This chained attack requires opening the device enclosure and attaching a serial adapter; it is not network-reachable. Despite a CVSS base score of 6.8 (Medium), real-world priority is LOW due to the AV:P vector, and EPSS is 0.24% (13th percentile); no public exploit code or CISA KEV entry has been identified at time of analysis.
Physical attackers with hands-on access to the circuit board of Phoenix Contact FL Switch and FL NAT managed industrial ethernet switches can read portions of the device filesystem by attaching to an undocumented UART port on the PCB, provided they also possess the hardcoded user credentials disclosed separately in CVE-2025-41692. The assessed vector (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6) is physical-only with read-only confidentiality impact and no integrity or availability effect, so remote and network exploitation are not possible; EPSS is 0.21% (10th percentile) and no public exploit code has been identified at time of analysis. Because the UART path requires the chained hardcoded-credential vulnerability, this is a targeted device-theft, insider, or supply-chain scenario rather than a scalable attack, and it remains a genuinely low-priority issue despite the 'High' confidentiality sub-metric.
Configuration tampering through cross-site scripting in dyn_conn.php affects the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT industrial switches, enabling an unauthenticated remote attacker to trick a concurrently authenticated administrator into submitting a manipulated POST request that alters device configuration parameters. The vulnerability is network-reachable and low-complexity but requires victim interaction (UI:R), and the impact is limited to WBM-exposed settings: no operating system or privileged functions are reachable, and the httpOnly session cookie prevents session hijacking. No public exploit identified at time of analysis; EPSS is 0.66% (50th percentile).
Authenticated but low-privileged users can hang the web management server on Phoenix Contact FL SWITCH and FL NAT industrial Ethernet devices by sending an empty webshell command composed only of whitespace - the server blocks indefinitely waiting for additional command data, consuming the connection/worker resource and producing a denial of service of the web interface (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, CWE-770). The flaw affects a very broad installed base spanning the FL SWITCH 2000, 2100, 2200, 2300, 2400, 2500, 2600 and 2700 series plus FL NAT 2208/2304 firmware, and is reachable over the network but requires valid low-privileged credentials on the management interface. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS score is only 0.48% (39th percentile), so this is a genuine but moderate availability issue rather than a critical one; impact is confined to the web/management server and does not extend to the switching/data plane, and segmentation plus credential restriction materially lowers exposure.
Authenticated low-privileged users on Phoenix Contact FL Switch and FL NAT industrial Ethernet switches can keep SSH-spawned processes running indefinitely, consuming device resources and degrading management-plane performance. The switching and forwarding data plane is unaffected, so the device stays online and forwarding traffic; only configuration, monitoring, and management responsiveness suffer. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.52% (42nd percentile), making this a genuinely low-priority hardening item rather than an urgent patch.
Phoenix Contact FL Switch and FL NAT managed Ethernet switches run firmware that derives the underlying operating system's 'root' and 'user' passwords using a weak generation algorithm, allowing a webUI administrator to brute-force or predict those credentials. Only attackers who already hold an admin account on the device's web management interface can exploit this (PR:H), but success lets them cross from the web layer into the OS, disclosing credentials and files with high confidentiality impact while integrity and availability are unaffected. Exploitation requires network reachability to the webUI; no user interaction is needed. No public exploit code or confirmed active exploitation is currently identified (EPSS 0.30%, ~20th percentile), and the CISA KEV catalog does not list this CVE, so real-world risk is moderate-to-low despite the 6.8 medium CVSS.
A security vulnerability in An unauthenticated adjacent attacker (CVSS 8.8). High severity vulnerability requiring prompt remediation.
An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.
An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.
A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.
A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.
A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watchdog.
An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service for these stations.
An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.
An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP environment variable which can lead to a DoS. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment variables which can lead to a DoS. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mGuard devices. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in mGuard devices. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY_HTTP_PORT in mGuard devices. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the pathfinder TCP encapsulation service. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An unauthenticated remote attacker can DoS a control agent due to access of a uninitialized pointer which may prevent or disrupt the charging functionality. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can DoS the control agent due to a out-of-bounds read which may prevent or disrupt the charging functionality. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can perform a log injection due to improper input validation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to gain full access to the device. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to gain full access to the device. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specially crafted HTTP POST when uploading a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 the SNMP daemon is running with root privileges allowing a remote attacker with knowledge of the SNMPv2 r/w community string. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem through a configuration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certificate operations to gain full access to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain full access to the device. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Input Validation vulnerability in PHOENIX CONTACT FL/TC MGUARD Family in multiple versions may allow UDP packets to bypass the filter rules and access the solely connected device behind the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A remote, unauthenticated attacker could cause a denial-of-service of PHOENIX CONTACT FL MGUARD and TC MGUARD devices below version 8.9.0 by sending a larger number of unauthenticated HTTPS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could lead to a heap buffer overflow and a read access violation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based management or the REST API with a manipulated. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Reflected cross-site scripting in the pxc_portSfp.php page of the web-based management (WBM) interface on Phoenix Contact FL Switch and FL NAT industrial Ethernet devices allows an unauthenticated remote attacker to craft a link that, when clicked by an already-authenticated WBM user, executes script in that user's browser context and alters device configuration parameters exposed by the web application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attacker needs no credentials but does require victim interaction; impact is capped at web-app configuration values, with no access to operating system internals or privileged functions, and the httpOnly session cookie prevents session hijacking. EPSS is 9.77% (95th percentile), indicating elevated short-term exploitation likelihood relative to typical XSS issues, though no public exploit code and no CISA KEV listing were identified at time of analysis.
Reflected cross-site scripting (XSS) in the pxc_portCntr.php endpoint of Phoenix Contact FL SWITCH and FL NAT industrial Ethernet switch firmware allows an unauthenticated remote attacker to socially engineer an operator who is actively logged into the device's web-based management (WBM) interface into clicking a crafted link; the injected script then executes in that authenticated session and can modify device configuration parameters exposed by the web application. CVSS:3.1 rates it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), with the scope change reflecting the crossed trust boundary between the attacker-supplied link and the operator's privileged WBM session, while the httpOnly session cookie flag prevents session hijacking and no operating-system-level or privileged functions are reachable. EPSS scores the flaw at 9.77% (95th percentile) likelihood of exploitation within 30 days, but there is no CISA KEV listing and no public exploit identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the pxc_PortCfg.php script of Phoenix Contact's web-based management (WBM) interface lets an unauthenticated remote attacker craft a link that, when clicked by an authenticated operator, silently modifies device configuration parameters exposed by the web application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attacker needs no credentials but does depend on victim user interaction, which is the primary limiting factor; EPSS is elevated at 9.77% (95th percentile), though no public exploit code and no CISA KEV listing were identified at time of analysis. Impact is bounded to WBM-scoped settings - the description explicitly rules out access to operating-system internals or privileged functions, and the httpOnly session cookie prevents session hijacking - so risk is genuine but LOW-to-MEDIUM and heavily dependent on whether the WBM interface is reachable and actively used by an operator.
Reflected cross-site scripting in port_util.php within the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT managed industrial Ethernet switches lets an unauthenticated remote attacker craft a link that, once clicked by an operator who is currently logged in to WBM, alters device-configuration parameters visible in the web application. The CVSS 3.1 base score of 7.1 is driven largely by the S:C scope change rather than by deep impact: confidentiality, integrity, and availability are each rated Low, the httpOnly session cookie prevents session hijacking, and the vendor states no access to operating-system internals or privileged functions is obtained. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.65% (49th percentile), so this is a genuine but modest-priority issue whose practical risk depends on whether the switch management plane is reachable from untrusted networks.
Cross-site scripting in the pxc_Dot1xCfg.php 802.1X configuration page of Phoenix Contact FL Switch and FL NAT industrial Ethernet switch firmware lets an unauthenticated remote attacker supply a crafted link that, when clicked by a user with an active web-based management (WBM) session, executes script in that user's browser and alters device configuration parameters reachable through the web application. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) confirms the attacker needs no authentication but does require victim interaction; impact is bounded to WBM-exposed settings, and the httpOnly session cookie prevents session hijacking. EPSS is 9.77% (95th percentile), indicating elevated predicted exploitation activity, but no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
Cross-site scripting in the Phoenix Contact FL SWITCH and FL NAT web-based management (WBM) interface - specifically the PHP script pxc_vlanIntfCfg.php - lets an unauthenticated remote attacker craft a malicious POST request that an already-authenticated operator is tricked into submitting, changing VLAN interface configuration parameters in that operator's WBM session. The attacker needs no credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) but must socially engineer a logged-in administrator into triggering the request, so exploitation depends on victim interaction and on the WBM interface being reachable on the network. Impact is deliberately bounded: the flaw reaches only web-application configuration parameters, not operating-system internals or privileged functions, and the httpOnly session cookie blocks session or credential theft; EPSS is elevated at 9.77% (95th percentile), but no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in the web-based management (WBM) interface of Phoenix Contact FL SWITCH industrial Ethernet switches - specifically the pxc_portSecCfg.php script - allows an unauthenticated remote attacker to craft malicious content that, once loaded by an authenticated WBM operator, submits a manipulated POST request and changes device configuration parameters exposed through the web application. User interaction by that authenticated operator is mandatory (UI:R), the session cookie is protected by the httpOnly flag so session hijacking is not achievable, and impact is confined to web-facing configuration settings rather than operating-system internals or privileged functions. EPSS is elevated at 9.77% (95th percentile) although no public exploit code has been identified at the time of analysis and the issue is not confirmed as actively exploited.
Cross-site scripting in the pxc_portCntr2.php endpoint of the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT industrial Ethernet switches allows an unauthenticated remote attacker (PR:N) to socially engineer a currently authenticated operator into submitting an attacker-crafted POST request that alters device configuration parameters exposed by the web application (CVSS 7.1, UI:R, scope changed). Impact is bounded: the vulnerability does not reach operating system internals or privileged functions, and the httpOnly session-cookie flag prevents the injected script from stealing or hijacking the authenticated session. EPSS is low (0.65%, ~49th percentile) and no public exploit or confirmed active exploitation was identified at time of analysis; success depends entirely on tricking an authenticated user into interacting with attacker-supplied content.
Successful exploitation of an undocumented UART port on the printed circuit board of Phoenix Contact FL Switch and FL NAT industrial Ethernet switches allows an attacker with physical access to obtain root-level control, particularly when combined with credentials harvested via CVE-2025-41692. This chained attack requires opening the device enclosure and attaching a serial adapter; it is not network-reachable. Despite a CVSS base score of 6.8 (Medium), real-world priority is LOW due to the AV:P vector, and EPSS is 0.24% (13th percentile); no public exploit code or CISA KEV entry has been identified at time of analysis.
Physical attackers with hands-on access to the circuit board of Phoenix Contact FL Switch and FL NAT managed industrial ethernet switches can read portions of the device filesystem by attaching to an undocumented UART port on the PCB, provided they also possess the hardcoded user credentials disclosed separately in CVE-2025-41692. The assessed vector (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6) is physical-only with read-only confidentiality impact and no integrity or availability effect, so remote and network exploitation are not possible; EPSS is 0.21% (10th percentile) and no public exploit code has been identified at time of analysis. Because the UART path requires the chained hardcoded-credential vulnerability, this is a targeted device-theft, insider, or supply-chain scenario rather than a scalable attack, and it remains a genuinely low-priority issue despite the 'High' confidentiality sub-metric.
Configuration tampering through cross-site scripting in dyn_conn.php affects the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT industrial switches, enabling an unauthenticated remote attacker to trick a concurrently authenticated administrator into submitting a manipulated POST request that alters device configuration parameters. The vulnerability is network-reachable and low-complexity but requires victim interaction (UI:R), and the impact is limited to WBM-exposed settings: no operating system or privileged functions are reachable, and the httpOnly session cookie prevents session hijacking. No public exploit identified at time of analysis; EPSS is 0.66% (50th percentile).
Authenticated but low-privileged users can hang the web management server on Phoenix Contact FL SWITCH and FL NAT industrial Ethernet devices by sending an empty webshell command composed only of whitespace - the server blocks indefinitely waiting for additional command data, consuming the connection/worker resource and producing a denial of service of the web interface (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, CWE-770). The flaw affects a very broad installed base spanning the FL SWITCH 2000, 2100, 2200, 2300, 2400, 2500, 2600 and 2700 series plus FL NAT 2208/2304 firmware, and is reachable over the network but requires valid low-privileged credentials on the management interface. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS score is only 0.48% (39th percentile), so this is a genuine but moderate availability issue rather than a critical one; impact is confined to the web/management server and does not extend to the switching/data plane, and segmentation plus credential restriction materially lowers exposure.
Authenticated low-privileged users on Phoenix Contact FL Switch and FL NAT industrial Ethernet switches can keep SSH-spawned processes running indefinitely, consuming device resources and degrading management-plane performance. The switching and forwarding data plane is unaffected, so the device stays online and forwarding traffic; only configuration, monitoring, and management responsiveness suffer. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.52% (42nd percentile), making this a genuinely low-priority hardening item rather than an urgent patch.
Phoenix Contact FL Switch and FL NAT managed Ethernet switches run firmware that derives the underlying operating system's 'root' and 'user' passwords using a weak generation algorithm, allowing a webUI administrator to brute-force or predict those credentials. Only attackers who already hold an admin account on the device's web management interface can exploit this (PR:H), but success lets them cross from the web layer into the OS, disclosing credentials and files with high confidentiality impact while integrity and availability are unaffected. Exploitation requires network reachability to the webUI; no user interaction is needed. No public exploit code or confirmed active exploitation is currently identified (EPSS 0.30%, ~20th percentile), and the CISA KEV catalog does not list this CVE, so real-world risk is moderate-to-low despite the 6.8 medium CVSS.
A security vulnerability in An unauthenticated adjacent attacker (CVSS 8.8). High severity vulnerability requiring prompt remediation.
An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.
An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.
A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.
A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.
A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watchdog.
An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service for these stations.
An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.
An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP environment variable which can lead to a DoS. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment variables which can lead to a DoS. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mGuard devices. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in mGuard devices. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY_HTTP_PORT in mGuard devices. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the pathfinder TCP encapsulation service. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An unauthenticated remote attacker can DoS a control agent due to access of a uninitialized pointer which may prevent or disrupt the charging functionality. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can DoS the control agent due to a out-of-bounds read which may prevent or disrupt the charging functionality. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can perform a log injection due to improper input validation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to gain full access to the device. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to gain full access to the device. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specially crafted HTTP POST when uploading a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 the SNMP daemon is running with root privileges allowing a remote attacker with knowledge of the SNMPv2 r/w community string. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem through a configuration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certificate operations to gain full access to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain full access to the device. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Input Validation vulnerability in PHOENIX CONTACT FL/TC MGUARD Family in multiple versions may allow UDP packets to bypass the filter rules and access the solely connected device behind the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A remote, unauthenticated attacker could cause a denial-of-service of PHOENIX CONTACT FL MGUARD and TC MGUARD devices below version 8.9.0 by sending a larger number of unauthenticated HTTPS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could lead to a heap buffer overflow and a read access violation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based management or the REST API with a manipulated. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.