Most recent entries from all

bdu:2018-01071

cnvd-2018-10150

EUVD-2026-64776

fkie_cve-2018-10729

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 allow reading the configuration file by an unauthenticated user.

GHSA-5rh6-9788-fh7g

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 allow reading the configuration file by an unauthenticated user.

gsd-2018-10729

ICSA-18-137-02 — PHOENIX CONTACT FL SWITCH 3xxx/4xxx/48xx Series

An attacker with permission to transfer configuration files to or from the switch or permission to upgrade firmware is able to execute arbitrary OS shell commands.CVE-2018-10730 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Web interface CGI applications may copy the contents of the running configuration file to a commonly accessed file. Manipulation of a web login request can expose the contents of this file through to the web browser. A successful web interface login attempt is not required to read the configuration file contents.CVE-2018-10729 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). An attacker may insert a carefully crafted cookie into a GET request to cause a buffer overflow that can initiate a denial of service attack and execute arbitrary code.CVE-2018-10728 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). A remote attacker may exploit a long cookie related vulnerability to cause a buffer overflow that allows unauthorized access to the switches operating system files and the insertion of executable code into the OS.CVE-2018-10731 has been assigned to this vulnerability. A CVSS v3 base score of 9.0 has been calculated; the CVSS vector string is…

VDE-2018-005 — Phoenix Contact: FL SWITCH 3xxx/4xxx/48xx series through 1.33 allows Information Exposure

Web interface CGI applications may copy the contents of the running configuration file to a commonly accessed file. Clever manipulation of a web login request can expose the contents of this file through to the web browser. A successful web interface login attempt is not required to read the configuration file contents.

FL SWITCH Configuration File can be read by unauthenticated user.