VDE-2024-019

Vulnerability from csaf_phoenixcontactgmbhcokg - Published: 2024-05-14 06:00 - Updated: 2024-05-14 06:00
Summary
Phoenix Contact: Multiple vulnerabilities in the Firmware of CHARX SEC charge controllers
Notes
Summary: Multiple vulnerabilities have been discovered in the Firmware of CHARX SEC charge controllers. Update: credis have been updated 
Impact: CVE-2024-28137: The exploit allows a local user to gain root privileges, which allows them to take over the device. CVE-2024-28134: The exploit allows an attacker without local account to get access to the web-basedmanagement with the privileges of the currently logged in user. CVE-2024-28135: The exploit allows a user of the web-based management to perform remote code execution on the device as a user with low privileges. CVE-2024-28133: The exploit allows a local user on the device to perform privilege escalation to gain rootprivileges. CVE-2024-28136: When the OCPP management port is opened, the exploit allows an attacker without localaccount to gain root privileges and perform remote code execution.
Mitigation: Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
Remediation: PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
CVE-2024-28137

A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Mitigation Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
Vendor Fix PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
Affected products
Product Identifier Version Remediation
Unresolved product id: CSAFPID-31001 —
Unresolved product id: CSAFPID-31002 —
Unresolved product id: CSAFPID-31003 —
Unresolved product id: CSAFPID-31004 —
Product Identifier Version Remediation
Unresolved product id: CSAFPID-32001 —
Unresolved product id: CSAFPID-32002 —
Unresolved product id: CSAFPID-32003 —
Unresolved product id: CSAFPID-32004 —
CVE-2024-28136

A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-20 - Improper Input Validation
Mitigation Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
Vendor Fix PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
Affected products
Product Identifier Version Remediation
Unresolved product id: CSAFPID-31001 —
Unresolved product id: CSAFPID-31002 —
Unresolved product id: CSAFPID-31003 —
Unresolved product id: CSAFPID-31004 —
Product Identifier Version Remediation
Unresolved product id: CSAFPID-32001 —
Unresolved product id: CSAFPID-32002 —
Unresolved product id: CSAFPID-32003 —
Unresolved product id: CSAFPID-32004 —
CVE-2024-28135

A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.

5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE-20 - Improper Input Validation
Mitigation Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
Vendor Fix PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
Affected products
Product Identifier Version Remediation
Unresolved product id: CSAFPID-31001 —
Unresolved product id: CSAFPID-31002 —
Unresolved product id: CSAFPID-31003 —
Unresolved product id: CSAFPID-31004 —
Product Identifier Version Remediation
Unresolved product id: CSAFPID-32001 —
Unresolved product id: CSAFPID-32002 —
Unresolved product id: CSAFPID-32003 —
Unresolved product id: CSAFPID-32004 —
CVE-2024-28134

An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected.

7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
CWE-319 - Cleartext Transmission of Sensitive Information
Mitigation Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
Vendor Fix PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
Affected products
Product Identifier Version Remediation
Unresolved product id: CSAFPID-31001 —
Unresolved product id: CSAFPID-31002 —
Unresolved product id: CSAFPID-31003 —
Unresolved product id: CSAFPID-31004 —
Product Identifier Version Remediation
Unresolved product id: CSAFPID-32001 —
Unresolved product id: CSAFPID-32002 —
Unresolved product id: CSAFPID-32003 —
Unresolved product id: CSAFPID-32004 —
CVE-2024-28133

A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-426 - Untrusted Search Path
Mitigation Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
Vendor Fix PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
Affected products
Product Identifier Version Remediation
Unresolved product id: CSAFPID-31001 —
Unresolved product id: CSAFPID-31002 —
Unresolved product id: CSAFPID-31003 —
Unresolved product id: CSAFPID-31004 —
Product Identifier Version Remediation
Unresolved product id: CSAFPID-32001 —
Unresolved product id: CSAFPID-32002 —
Unresolved product id: CSAFPID-32003 —
Unresolved product id: CSAFPID-32004 —
References
Acknowledgments
CERT@VDE certvde.com
SinSinology Sina Kheirkhah
Trend Micro's Zero Day Initiative @ByteInsight Todd Manning
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      },
      {
        "names": [
          "Sina Kheirkhah"
        ],
        "organization": "SinSinology",
        "summary": "reporting"
      },
      {
        "names": [
          "@ByteInsight",
          "Todd Manning"
        ],
        "organization": "Trend Micro\u0027s Zero Day Initiative",
        "summary": "reporting"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple vulnerabilities have been discovered in the Firmware of CHARX SEC charge controllers.\nUpdate:\u00a0credis have been updated\u00a0",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "CVE-2024-28137:\u00a0The exploit allows a local user to gain root privileges, which allows them to take over the device.\n\nCVE-2024-28134:\u00a0The exploit allows an attacker without local account to get access to the web-basedmanagement with the privileges of the currently logged in user.\n\nCVE-2024-28135:\u00a0The exploit allows a user of the web-based management to perform remote code execution on the device as a user with low privileges.\n\nCVE-2024-28133:\u00a0The exploit allows a local user on the device to perform privilege escalation to gain rootprivileges.\n\nCVE-2024-28136:\u00a0When the OCPP management port is opened, the exploit allows an attacker without localaccount to gain root privileges and perform remote code execution.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note.\nMeasures to protect network-capable devices with Ethernet connection",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@phoenixcontact.com",
      "name": "Phoenix Contact GmbH \u0026 Co. KG",
      "namespace": "https://phoenixcontact.com/psirt"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2024-019: Phoenix Contact: Multiple vulnerabilities in the Firmware of CHARX SEC charge controllers - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2024-019/"
      },
      {
        "category": "self",
        "summary": "VDE-2024-019: Phoenix Contact: Multiple vulnerabilities in the Firmware of CHARX SEC charge controllers - CSAF",
        "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2024/vde-2024-019.json"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://phoenixcontact.com/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Phoenix Contact GmbH \u0026 Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/phoenixcontact/"
      }
    ],
    "title": "Phoenix Contact: Multiple vulnerabilities in the Firmware of CHARX SEC charge controllers",
    "tracking": {
      "aliases": [
        "VDE-2024-019"
      ],
      "current_release_date": "2024-05-14T06:00:00.000Z",
      "generator": {
        "date": "2025-04-24T07:19:00.306Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.23"
        }
      },
      "id": "VDE-2024-019",
      "initial_release_date": "2024-05-14T06:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-05-14T06:00:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CHARX SEC-3000",
                "product": {
                  "name": "CHARX SEC-3000",
                  "product_id": "CSAFPID-11001",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1139022"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "CHARX SEC-3050",
                "product": {
                  "name": "CHARX SEC-3050",
                  "product_id": "CSAFPID-11002",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1139018"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "CHARX SEC-3100",
                "product": {
                  "name": "CHARX SEC-3100",
                  "product_id": "CSAFPID-11003",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1139012"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "CHARX SEC-3150",
                "product": {
                  "name": "CHARX SEC-3150",
                  "product_id": "CSAFPID-11004",
                  "product_identification_helper": {
                    "model_numbers": [
                      "1138965"
                    ]
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=1.5.1",
                "product": {
                  "name": "Firmware \u003c=1.5.1",
                  "product_id": "CSAFPID-21001"
                }
              },
              {
                "category": "product_version",
                "name": "1.6",
                "product": {
                  "name": "Firmware 1.6",
                  "product_id": "CSAFPID-22001"
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "Phoenix Contact"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004"
        ],
        "summary": "Fixed products."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=1.5.1 installed on CHARX SEC-3000",
          "product_id": "CSAFPID-31001"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=1.5.1 installed on CHARX SEC-3050",
          "product_id": "CSAFPID-31002"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=1.5.1 installed on CHARX SEC-3100",
          "product_id": "CSAFPID-31003"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=1.5.1 installed on CHARX SEC-3150",
          "product_id": "CSAFPID-31004"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 1.6 installed on CHARX SEC-3000",
          "product_id": "CSAFPID-32001"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 1.6 installed on CHARX SEC-3050",
          "product_id": "CSAFPID-32002"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 1.6 installed on CHARX SEC-3100",
          "product_id": "CSAFPID-32003"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 1.6 installed on CHARX SEC-3150",
          "product_id": "CSAFPID-32004"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11004"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-28137",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "notes": [
        {
          "category": "description",
          "text": "A local attacker with low privileges can\u00a0perform a privilege escalation with an init script due to a  TOCTOU vulnerability.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note.\nMeasures to protect network-capable devices with Ethernet connection",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004"
          ]
        }
      ],
      "title": "CVE-2024-28137"
    },
    {
      "cve": "CVE-2024-28136",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "A local attacker with low privileges can use a command injection vulnerability to gain root\nprivileges due to improper input validation using the OCPP Remote service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note.\nMeasures to protect network-capable devices with Ethernet connection",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004"
          ]
        }
      ],
      "title": "CVE-2024-28136"
    },
    {
      "cve": "CVE-2024-28135",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "A low privileged remote attacker can use\u00a0a command injection vulnerability in the API which performs\nremote code execution as the user-app\u00a0user\u00a0due to improper input validation. The confidentiality is partly affected.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note.\nMeasures to protect network-capable devices with Ethernet connection",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "temporalScore": 5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004"
          ]
        }
      ],
      "title": "CVE-2024-28135"
    },
    {
      "cve": "CVE-2024-28134",
      "cwe": {
        "id": "CWE-319",
        "name": "Cleartext Transmission of Sensitive Information"
      },
      "notes": [
        {
          "category": "description",
          "text": "An unauthenticated remote attacker can extract a session token with a MitM attack and gain\u00a0web-based\nmanagement access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required.\u00a0The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note.\nMeasures to protect network-capable devices with Ethernet connection",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "environmentalScore": 7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004"
          ]
        }
      ],
      "title": "CVE-2024-28134"
    },
    {
      "cve": "CVE-2024-28133",
      "cwe": {
        "id": "CWE-426",
        "name": "Untrusted Search Path"
      },
      "notes": [
        {
          "category": "description",
          "text": "A local low privileged attacker can use an untrusted search path in a\u00a0CHARX system utility to gain\u00a0root\nprivileges.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note.\nMeasures to protect network-capable devices with Ethernet connection",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004"
          ]
        }
      ],
      "title": "CVE-2024-28133"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.