CVE-2023-3526
PHOENIX CONTACT: Cross-site Scripting vulnerability in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devices
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Productos afectados
PHOENIX CONTACT · CLOUD CLIENT 1101T-TX/TXPHOENIX CONTACT · TC CLOUD CLIENT 1002-4GPHOENIX CONTACT · TC CLOUD CLIENT 1002-4G ATTPHOENIX CONTACT · TC CLOUD CLIENT 1002-4G VZWPHOENIX CONTACT · TC ROUTER 3002T-4GPHOENIX CONTACT · TC ROUTER 3002T-4G ATTPHOENIX CONTACT · TC ROUTER 3002T-4G VZWPoCs públicas encontradas — 1
cve_referencepacketstormsecurity.com/files/174152/Phoenix-Contact-TC-Cloud-TC-Router-2.x-XSS-Memory-Consumption.htmlno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →