CVE-2024-28134: high-severity vulnerability in PHOENIX CONTACT CHARX SEC-3000
PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7epss 0.5%
An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based
management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected products
PHOENIX CONTACT · CHARX SEC-3000PHOENIX CONTACT · CHARX SEC-3050PHOENIX CONTACT · CHARX SEC-3100PHOENIX CONTACT · CHARX SEC-3150Related CVEs — PHOENIX CONTACT CHARX SEC-3000
In the same product, most dangerous first.
CVE-2024-25998HIGHPHOENIX CONTACT: Command injection in the OCPP ServiceEPSS 1.5%CVE-2024-25995CRITICALPHOENIX CONTACT: Remote code execution in CHARX SeriesEPSS 1.4%CVE-2024-28135MEDIUMPHOENIX CONTACT: command injection vulnerability in the API of the CHARX SeriesEPSS 1.3%CVE-2024-26003HIGHPHOENIX CONTACT: DoS of the control agent in CHARX SeriesEPSS 1.2%CVE-2024-26004HIGHPHOENIX CONTACT: DoS of a control agent due to access of a uninitialized pointer in CHARX SeriesEPSS 1.0%CVE-2024-26001HIGHPHOENIX CONTACT: Out of bounds write only memory accessEPSS 0.9%