Vulnerabilities > Phoenixcontact
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-09-10 | CVE-2024-7699 | OS Command Injection vulnerability in Phoenixcontact products An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data. | 8.8 |
| 2024-09-10 | CVE-2024-7734 | Allocation of Resources Without Limits or Throttling vulnerability in Phoenixcontact products An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the pathfinder TCP encapsulation service. | 5.3 |
| 2024-08-13 | CVE-2024-6788 | Unspecified vulnerability in Phoenixcontact products A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password. | 9.8 |
| 2024-08-13 | CVE-2024-3913 | Unspecified vulnerability in Phoenixcontact products An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup. | 5.9 |
| 2024-03-12 | CVE-2024-25996 | Unspecified vulnerability in Phoenixcontact products An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. | 9.8 |
| 2024-03-12 | CVE-2024-25999 | Unspecified vulnerability in Phoenixcontact products An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service. | 7.8 |
| 2024-03-12 | CVE-2024-26000 | Out-of-bounds Read vulnerability in Phoenixcontact products An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization. | 7.5 |
| 2024-03-12 | CVE-2024-26001 | Out-of-bounds Write vulnerability in Phoenixcontact products An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. | 9.8 |
| 2023-08-09 | CVE-2023-37856 | Unspecified vulnerability in Phoenixcontact products In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem through a configuration dialog within the embedded Qt browser . | 4.3 |
| 2023-08-09 | CVE-2023-37857 | Unspecified vulnerability in Phoenixcontact products In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. | 7.2 |