126
CVEs
23
Critical
74
High
0
KEV
5
PoC
80
Unpatched C/H
18.3%
Patch Rate
1.8%
Avg EPSS
Severity Breakdown
CRITICAL
23
HIGH
74
MEDIUM
29
LOW
0
Monthly CVE Trend
Affected Products (30)
Charx Sec 3050 Firmware
29
Charx Sec 3150 Firmware
29
Charx Sec 3000 Firmware
29
Charx Sec 3100 Firmware
29
Fl Mguard Rs4004 Tx Dtx Firmware
15
Fl Mguard Rs4004 Tx Dtx Vpn Firmware
15
Fl Mguard Smart2 Firmware
14
Wp 6101 Wxps Firmware
14
Fl Mguard Gt Gt Firmware
14
Fl Mguard Rs2005 Tx Vpn Firmware
14
Tc Mguard Rs4000 4G Att Vpn Firmware
14
Tc Mguard Rs4000 3G Vpn Firmware
14
Fl Mguard Core Tx Vpn Firmware
14
Fl Mguard Rs2000 Tx Tx B Firmware
14
Fl Mguard Pcie4000 Vpn Firmware
14
Wp 6121 Wxps Firmware
14
Fl Mguard Delta Tx Tx Firmware
14
Tc Mguard Rs4000 4G Vpn Firmware
14
Fl Mguard Pci4000 Vpn Firmware
14
Wp 6070 Wvps Firmware
14
Fl Mguard Centerport Vpn 1000 Firmware
14
Wp 6185 Whps Firmware
14
Fl Mguard Smart2 Vpn Firmware
14
Fl Mguard Rs4000 Tx Tx Vpn Firmware
14
Fl Mguard Gt Gt Vpn Firmware
14
Fl Mguard Core Tx Firmware
14
Fl Mguard Rs2000 Tx Tx Vpn Firmware
14
Wp 6215 Whps Firmware
14
Tc Mguard Rs4000 4G Vzw Vpn Firmware
14
Fl Mguard Pcie4000 Firmware
14
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2017-5753 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Rated medium severity (CVSS 5.6). Public exploit code available and EPSS exploitation probability 94.3%. | MEDIUM | 5.6 | 94.3% | 142 |
PoC
|
| CVE-2019-9201 | Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.5% | 71 |
PoC
No patch
|
| CVE-2022-31800 | An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.5% | 69 |
PoC
No patch
|
| CVE-2020-9436 | PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 2.6% | 64 |
PoC
No patch
|
| CVE-2020-9435 | PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 1.2% | 58 |
PoC
No patch
|
| CVE-2023-3572 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 10.0 | 0.8% | 50 |
No patch
|
| CVE-2017-5159 | An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.7% | 50 |
No patch
|
| CVE-2025-25270 | An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations. | CRITICAL | 9.8 | 0.5% | 49 |
|
| CVE-2020-12519 | On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.9% | 49 |
No patch
|
| CVE-2022-31801 | An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.0% | 49 |
No patch
|
| CVE-2023-3935 | A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.5% | 49 |
No patch
|
| CVE-2023-0757 | Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.9% | 49 |
No patch
|
| CVE-2023-46141 | Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.9% | 49 |
No patch
|
| CVE-2024-25995 | An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.4% | 49 |
No patch
|
| CVE-2024-25996 | An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|