CVE-2020-12518: falha de média gravidade em Phoenix Contact AXC F 1152 (1151412)
Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.5epss 0.7%
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Phoenix Contact · AXC F 1152 (1151412)Phoenix Contact · AXC F 2152 (2404267)Phoenix Contact · AXC F 2152 Starterkit (1046568)Phoenix Contact · AXC F 3152 (1069208)Phoenix Contact · PLCnext Technology Starterkit (1188165)Phoenix Contact · RFC 4072S (1051328CVEs relacionadas — Phoenix Contact AXC F 1152 (1151412)
No mesmo produto, das mais perigosas para as menos.
CVE-2020-12517HIGHPhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).EPSS 1.1%CVE-2020-12519HIGHPhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use this vulnerability i.e. to open a reverse shell with root privileges.EPSS 0.9%CVE-2020-12521MEDIUMPhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: A specially crafted LLDP packet may lead to a high system load in the PROFINET stack.EPSS 0.5%