Most recent entries from all

bdu:2018-01072

cnvd-2018-10151

EUVD-2026-64819

fkie_cve-2018-10730

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection.

GHSA-v9j3-6w7p-3346

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection.

gsd-2018-10730

ICSA-18-137-02 — PHOENIX CONTACT FL SWITCH 3xxx/4xxx/48xx Series

An attacker with permission to transfer configuration files to or from the switch or permission to upgrade firmware is able to execute arbitrary OS shell commands.CVE-2018-10730 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Web interface CGI applications may copy the contents of the running configuration file to a commonly accessed file. Manipulation of a web login request can expose the contents of this file through to the web browser. A successful web interface login attempt is not required to read the configuration file contents.CVE-2018-10729 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). An attacker may insert a carefully crafted cookie into a GET request to cause a buffer overflow that can initiate a denial of service attack and execute arbitrary code.CVE-2018-10728 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). A remote attacker may exploit a long cookie related vulnerability to cause a buffer overflow that allows unauthorized access to the switches operating system files and the insertion of executable code into the OS.CVE-2018-10731 has been assigned to this vulnerability. A CVSS v3 base score of 9.0 has been calculated; the CVSS vector string is…

VDE-2018-004 — Phoenix Contact: FL SWITCH 3xxx/4xxx/48xx series through 1.33 allows Command Injection

An attacker with permission to transfer configuration files to/from the switch or permission to upgrade firmware, is able to execute arbitrary OS shell commands. CGI applications config_transfer.cgi and software_update.cgi are prone to OS command injection through targeted manipulation of their web-request headers.