Vulnerabilites related to phoenixcontact - multiprog
CVE-2023-5592 (GCVE-0-2023-5592)
Vulnerability from cvelistv5
Published
2023-12-14 14:04
Modified
2024-08-02 08:07
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-494 - Download of Code Without Integrity Check
Summary
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | PHOENIX CONTACT | MULTIPROG |
Version: all |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:07:31.902Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-054/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MULTIPROG",
"vendor": "PHOENIX CONTACT",
"versions": [
{
"status": "affected",
"version": "all"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ProConOS eCLR (SDK)",
"vendor": "PHOENIX CONTACT",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Reid Wightman of Dragos, Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity."
}
],
"value": "Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-494",
"description": "CWE-494 Download of Code Without Integrity Check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-14T14:04:41.083Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/en/advisories/VDE-2023-054/"
}
],
"source": {
"advisory": "VDE-2023-051",
"defect": [
"CERT@VDE#64360"
],
"discovery": "EXTERNAL"
},
"title": "Phoenix Contact: ProConOs prone to Download of Code Without Integrity Check",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2023-5592",
"datePublished": "2023-12-14T14:04:41.083Z",
"dateReserved": "2023-10-16T05:31:39.868Z",
"dateUpdated": "2024-08-02T08:07:31.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-31801 (GCVE-0-2022-31801)
Vulnerability from cvelistv5
Published
2022-06-21 08:00
Modified
2024-09-16 18:50
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Summary
An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
References
| ▼ | URL | Tags |
|---|---|---|
| https://cert.vde.com/en/advisories/VDE-2022-026/ | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | PHOENIX CONTACT | MULTIPROG |
Version: All Versions |
|||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:26:01.136Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-026/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MULTIPROG",
"vendor": "PHOENIX CONTACT",
"versions": [
{
"status": "affected",
"version": "All Versions"
}
]
},
{
"product": "ProConOS",
"vendor": "PHOENIX CONTACT",
"versions": [
{
"status": "affected",
"version": "All Versions"
}
]
},
{
"product": "ProConOS eCLR",
"vendor": "PHOENIX CONTACT",
"versions": [
{
"status": "affected",
"version": "All Versions"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was reported by Forescout."
}
],
"datePublic": "2022-06-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-21T08:00:31",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-026/"
}
],
"source": {
"advisory": "VDE-2022-026",
"discovery": "EXTERNAL"
},
"title": "Insufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering tool",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2022-06-21T07:00:00.000Z",
"ID": "CVE-2022-31801",
"STATE": "PUBLIC",
"TITLE": "Insufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering tool"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MULTIPROG",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "All Versions",
"version_value": "All Versions"
}
]
}
},
{
"product_name": "ProConOS",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "All Versions",
"version_value": "All Versions"
}
]
}
},
{
"product_name": "ProConOS eCLR",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "All Versions",
"version_value": "All Versions"
}
]
}
}
]
},
"vendor_name": "PHOENIX CONTACT"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability was reported by Forescout."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-345 Insufficient Verification of Data Authenticity"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert.vde.com/en/advisories/VDE-2022-026/",
"refsource": "CONFIRM",
"url": "https://cert.vde.com/en/advisories/VDE-2022-026/"
}
]
},
"source": {
"advisory": "VDE-2022-026",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-31801",
"datePublished": "2022-06-21T08:00:31.688772Z",
"dateReserved": "2022-05-30T00:00:00",
"dateUpdated": "2024-09-16T18:50:12.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-0757 (GCVE-0-2023-0757)
Vulnerability from cvelistv5
Published
2023-12-14 14:04
Modified
2024-08-02 05:24
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Summary
Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | PHOENIX CONTACT | MULTIPROG |
Version: all |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:24:33.525Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-051/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MULTIPROG",
"vendor": "PHOENIX CONTACT",
"versions": [
{
"status": "affected",
"version": "all"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ProConOS eCLR (SDK)",
"vendor": "PHOENIX CONTACT",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Reid Wightman from Dragos, Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device."
}
],
"value": "Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-14T14:04:10.708Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/en/advisories/VDE-2023-051/"
}
],
"source": {
"advisory": "VDE-2023-051",
"defect": [
"CERT@VDE#64360"
],
"discovery": "EXTERNAL"
},
"title": "Phoenix Contact ProConOS prone to Incorrect Permission Assignment for Critical Resource",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2023-0757",
"datePublished": "2023-12-14T14:04:10.708Z",
"dateReserved": "2023-02-09T07:59:40.921Z",
"dateUpdated": "2024-08-02T05:24:33.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2022-06-21 08:15
Modified
2024-11-21 07:05
Severity ?
Summary
An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| info@cert.vde.com | https://cert.vde.com/en/advisories/VDE-2022-026/ | Mitigation, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert.vde.com/en/advisories/VDE-2022-026/ | Mitigation, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phoenixcontact | multiprog | * | |
| phoenixcontact | proconos | * | |
| phoenixcontact-software | proconos_eclr | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phoenixcontact:multiprog:*:*:*:*:*:*:*:*",
"matchCriteriaId": "42452860-CB53-479D-ADE1-E8166EC834C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:phoenixcontact:proconos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "80770720-B149-44CA-B6CA-25EB8C9A115C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:phoenixcontact-software:proconos_eclr:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4CDFE3B8-1A42-4E5E-92BD-5F1B07EF0377",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device."
},
{
"lang": "es",
"value": "Un atacante remoto no autenticado podr\u00eda cargar l\u00f3gica maliciosa en los dispositivos basados en ProConOS/ProConOS eCLR para conseguir el control total del dispositivo"
}
],
"id": "CVE-2022-31801",
"lastModified": "2024-11-21T07:05:21.537",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "info@cert.vde.com",
"type": "Secondary"
}
]
},
"published": "2022-06-21T08:15:07.587",
"references": [
{
"source": "info@cert.vde.com",
"tags": [
"Mitigation",
"Third Party Advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-026/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Third Party Advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-026/"
}
],
"sourceIdentifier": "info@cert.vde.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-345"
}
],
"source": "info@cert.vde.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-12-14 14:15
Modified
2024-11-21 08:42
Severity ?
Summary
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| info@cert.vde.com | https://cert.vde.com/en/advisories/VDE-2023-054/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert.vde.com/en/advisories/VDE-2023-054/ | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phoenixcontact | multiprog | * | |
| phoenixcontact | proconos_eclr | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phoenixcontact:multiprog:*:*:*:*:*:*:*:*",
"matchCriteriaId": "42452860-CB53-479D-ADE1-E8166EC834C4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phoenixcontact:proconos_eclr:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B9A422FD-2C4C-4B77-B619-6747474A3FA7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity."
},
{
"lang": "es",
"value": "Vulnerabilidad de descarga de c\u00f3digo sin verificaci\u00f3n de integridad en PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) permite a un atacante remoto no autenticado descargar y ejecutar aplicaciones sin verificaciones de integridad en el dispositivo, lo que puede resultar en una p\u00e9rdida total de integridad."
}
],
"id": "CVE-2023-5592",
"lastModified": "2024-11-21T08:42:05.330",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "info@cert.vde.com",
"type": "Primary"
}
]
},
"published": "2023-12-14T14:15:45.427",
"references": [
{
"source": "info@cert.vde.com",
"tags": [
"Third Party Advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-054/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-054/"
}
],
"sourceIdentifier": "info@cert.vde.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-494"
}
],
"source": "info@cert.vde.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-12-14 14:15
Modified
2024-11-21 07:37
Severity ?
Summary
Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| info@cert.vde.com | https://cert.vde.com/en/advisories/VDE-2023-051/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert.vde.com/en/advisories/VDE-2023-051/ | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phoenixcontact | multiprog | * | |
| phoenixcontact | proconos_eclr | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phoenixcontact:multiprog:*:*:*:*:*:*:*:*",
"matchCriteriaId": "42452860-CB53-479D-ADE1-E8166EC834C4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phoenixcontact:proconos_eclr:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B9A422FD-2C4C-4B77-B619-6747474A3FA7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device."
},
{
"lang": "es",
"value": "Asignaci\u00f3n de permisos incorrecta para una vulnerabilidad de recursos cr\u00edticos en PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) permite a un atacante remoto no autenticado cargar c\u00f3digo malicioso arbitrario y obtener acceso completo al dispositivo afectado."
}
],
"id": "CVE-2023-0757",
"lastModified": "2024-11-21T07:37:45.723",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "info@cert.vde.com",
"type": "Primary"
}
]
},
"published": "2023-12-14T14:15:42.083",
"references": [
{
"source": "info@cert.vde.com",
"tags": [
"Third Party Advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-051/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-051/"
}
],
"sourceIdentifier": "info@cert.vde.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-732"
}
],
"source": "info@cert.vde.com",
"type": "Primary"
}
]
}
var-201501-0401
Vulnerability from variot
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic. Phoenix Contact ProConOs and MultiProg are applications that run processes to control and manage IEC 61131 logic. Phoenix Contact ProConOs and MultiProg are prone to an authentication-bypass vulnerability. Attackers can exploit this issue to bypass authentication mechanism and gain unauthorized access. http://drupal.org/node/207891
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201501-0401",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "multiprog",
"scope": "eq",
"trust": 1.6,
"vendor": "phoenixcontact",
"version": "5.0"
},
{
"model": "proconos eclr",
"scope": "eq",
"trust": 1.0,
"vendor": "phoenixcontact",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.8,
"vendor": "proconos eclr",
"version": "*"
},
{
"model": "multiprog",
"scope": "eq",
"trust": 0.8,
"vendor": "phoenix contact",
"version": null
},
{
"model": "proconos",
"scope": "eq",
"trust": 0.8,
"vendor": "phoenix contact",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.6,
"vendor": "multiprog",
"version": "5.0"
},
{
"model": "contact phoenix contact proconos and multiprog",
"scope": null,
"trust": 0.6,
"vendor": "phoenix",
"version": null
},
{
"model": "proconos eclr",
"scope": "eq",
"trust": 0.6,
"vendor": "pheonixcontact",
"version": "visual_studio"
},
{
"model": "proconos eclr",
"scope": null,
"trust": 0.6,
"vendor": "pheonixcontact",
"version": null
},
{
"model": "proconos eclr",
"scope": "eq",
"trust": 0.6,
"vendor": "pheonixcontact",
"version": "single_chip"
},
{
"model": "multiprog",
"scope": "eq",
"trust": 0.6,
"vendor": "pheonixcontact",
"version": "5.0"
},
{
"model": "proconos eclr",
"scope": "eq",
"trust": 0.6,
"vendor": "pheonixcontact",
"version": "softplc"
},
{
"model": "contact proconos",
"scope": "eq",
"trust": 0.3,
"vendor": "phoenix",
"version": "0"
},
{
"model": "contact multiprog",
"scope": "eq",
"trust": 0.3,
"vendor": "phoenix",
"version": "0"
}
],
"sources": [
{
"db": "IVD",
"id": "a90acc0a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00410"
},
{
"db": "BID",
"id": "72063"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007726"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-318"
},
{
"db": "NVD",
"id": "CVE-2014-9195"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:pheonixcontact-software:multiprog",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:pheonixcontact-software:proconos_eclr",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007726"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Reid Wightman of Digital Bond.",
"sources": [
{
"db": "BID",
"id": "72063"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-318"
}
],
"trust": 0.9
},
"cve": "CVE-2014-9195",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2014-9195",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-00410",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "a90acc0a-2351-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-9195",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2014-9195",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2015-00410",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201501-318",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "a90acc0a-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "a90acc0a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00410"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007726"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-318"
},
{
"db": "NVD",
"id": "CVE-2014-9195"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic. Phoenix Contact ProConOs and MultiProg are applications that run processes to control and manage IEC 61131 logic. Phoenix Contact ProConOs and MultiProg are prone to an authentication-bypass vulnerability. \nAttackers can exploit this issue to bypass authentication mechanism and gain unauthorized access. \nhttp://drupal.org/node/207891",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-9195"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007726"
},
{
"db": "CNVD",
"id": "CNVD-2015-00410"
},
{
"db": "BID",
"id": "72063"
},
{
"db": "IVD",
"id": "a90acc0a-2351-11e6-abef-000c29c66e3d"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-9195",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-15-013-03",
"trust": 3.3
},
{
"db": "BID",
"id": "72063",
"trust": 1.5
},
{
"db": "EXPLOIT-DB",
"id": "37066",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2015-00410",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201501-318",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007726",
"trust": 0.8
},
{
"db": "BID",
"id": "72064",
"trust": 0.6
},
{
"db": "IVD",
"id": "A90ACC0A-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "a90acc0a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00410"
},
{
"db": "BID",
"id": "72063"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007726"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-318"
},
{
"db": "NVD",
"id": "CVE-2014-9195"
}
]
},
"id": "VAR-201501-0401",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "a90acc0a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00410"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "a90acc0a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00410"
}
]
},
"last_update_date": "2024-11-23T22:52:49.169000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.phoenixcontact.com/online/portal/de?1dmy\u0026urile=wcm%3apath%3a/dede/web/home"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007726"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007726"
},
{
"db": "NVD",
"id": "CVE-2014-9195"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-013-03"
},
{
"trust": 1.0,
"url": "https://www.exploit-db.com/exploits/37066/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9195"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-9195"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/72064"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/72063"
},
{
"trust": 0.3,
"url": "https://www.phoenixcontact.com/online/portal/pc"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-00410"
},
{
"db": "BID",
"id": "72063"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007726"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-318"
},
{
"db": "NVD",
"id": "CVE-2014-9195"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "a90acc0a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00410"
},
{
"db": "BID",
"id": "72063"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007726"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-318"
},
{
"db": "NVD",
"id": "CVE-2014-9195"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-19T00:00:00",
"db": "IVD",
"id": "a90acc0a-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2015-01-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-00410"
},
{
"date": "2015-01-13T00:00:00",
"db": "BID",
"id": "72063"
},
{
"date": "2015-01-23T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007726"
},
{
"date": "2015-01-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201501-318"
},
{
"date": "2015-01-17T02:59:05.630000",
"db": "NVD",
"id": "CVE-2014-9195"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-00410"
},
{
"date": "2015-01-13T00:00:00",
"db": "BID",
"id": "72063"
},
{
"date": "2015-01-23T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007726"
},
{
"date": "2015-01-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201501-318"
},
{
"date": "2024-11-21T02:20:22.783000",
"db": "NVD",
"id": "CVE-2014-9195"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201501-318"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Phoenix Contact ProConOs and MultiProg Vulnerabilities in arbitrary command execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007726"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Trust management",
"sources": [
{
"db": "IVD",
"id": "a90acc0a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-318"
}
],
"trust": 0.8
}
}