CVE-2024-28134: fallo de gravedad alta en PHOENIX CONTACT CHARX SEC-3000
PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7epss 0.5%
An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based
management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Productos afectados
PHOENIX CONTACT · CHARX SEC-3000PHOENIX CONTACT · CHARX SEC-3050PHOENIX CONTACT · CHARX SEC-3100PHOENIX CONTACT · CHARX SEC-3150CVEs relacionadas — PHOENIX CONTACT CHARX SEC-3000
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-25998HIGHPHOENIX CONTACT: Command injection in the OCPP ServiceEPSS 1.5%CVE-2024-25995CRITICALPHOENIX CONTACT: Remote code execution in CHARX SeriesEPSS 1.4%CVE-2024-28135MEDIUMPHOENIX CONTACT: command injection vulnerability in the API of the CHARX SeriesEPSS 1.3%CVE-2024-26003HIGHPHOENIX CONTACT: DoS of the control agent in CHARX SeriesEPSS 1.2%CVE-2024-26004HIGHPHOENIX CONTACT: DoS of a control agent due to access of a uninitialized pointer in CHARX SeriesEPSS 1.0%CVE-2024-26001HIGHPHOENIX CONTACT: Out of bounds write only memory accessEPSS 0.9%