Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 191

Export CSV
CVE-2024-28134

PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series

An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected. 

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Charx Sec-3000 Charx Sec-3000 Firmware Charx Sec-3050 and 5 more
CVE-2024-26004

PHOENIX CONTACT: DoS of a control agent due to access of a uninitialized pointer in CHARX Series

An unauthenticated remote attacker can DoS a control agent due to access of a uninitialized pointer which may prevent or disrupt the charging functionality.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Phoenixcontact
Products
Charx Sec-3000 Charx Sec-3000 Firmware Charx Sec-3050 and 5 more
CVE-2023-2673

PHOENIX CONTACT: FL/TC MGUARD prone to Improper Input Validation

Improper Input Validation vulnerability in PHOENIX CONTACT FL/TC MGUARD Family in multiple versions may allow UDP packets to bypass the filter rules and access the solely connected device behind the MGUARD which can be used for flooding attacks.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Fl Mguard 2102 Fl Mguard 2102 Firmware Fl Mguard 4102 Pci and 49 more
CVE-2023-5592

Phoenix Contact: ProConOs prone to Download of Code Without Integrity Check

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Multiprog Proconos Eclr
CVE-2023-46144

PHOENIX CONTACT: PLCnext Control prone to download of code without integrity check

A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Axc F 1152 Axc F 1152 Firmware Axc F 2152 and 14 more
CVE-2023-46142

PHOENIX CONTACT: Insufficient Read and Write Protection to Logic and Runtime Data in PLCnext Control

A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Axc F 1152 Axc F 1152 Firmware Axc F 2152 and 14 more
CVE-2023-46141

Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Automationworx Software Suite Axc 1050 Axc 1050 Firmware and 28 more
CVE-2023-3573

PHOENIX CONTACT: Command Injection in WP 6xxx Web panels

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration operations to gain full access to the device.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Phoenixcontact
Products
Wp 6070-wvps Wp 6070-wvps Firmware Wp 6101-wxps and 9 more
CVE-2023-3572

PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device.

CVSS 3.1 · 10 Critical EPSS 1.0% KEV · Not listed
Vendors
Phoenixcontact
Products
Wp 6070-wvps Wp 6070-wvps Firmware Wp 6101-wxps and 9 more