Vulnerabilities > Phoenixcontact
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-09-10 | CVE-2024-7699 | OS Command Injection vulnerability in Phoenixcontact products An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data. | 8.8 |
| 2024-09-10 | CVE-2024-7734 | Allocation of Resources Without Limits or Throttling vulnerability in Phoenixcontact products An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the pathfinder TCP encapsulation service. | 5.3 |
| 2024-08-13 | CVE-2024-3913 | Files or Directories Accessible to External Parties vulnerability in Phoenixcontact products An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup. | 5.3 |
| 2023-12-14 | CVE-2023-0757 | Incorrect Permission Assignment for Critical Resource vulnerability in Phoenixcontact Multiprog and Proconos Eclr Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device. | 9.8 |
| 2023-12-14 | CVE-2023-46141 | Incorrect Permission Assignment for Critical Resource vulnerability in Phoenixcontact products Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device. | 9.8 |
| 2023-12-14 | CVE-2023-46142 | Incorrect Permission Assignment for Critical Resource vulnerability in Phoenixcontact products A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices. | 8.8 |
| 2023-12-14 | CVE-2023-46143 | Download of Code Without Integrity Check vulnerability in Phoenixcontact products Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC. | 7.5 |
| 2023-12-14 | CVE-2023-46144 | Download of Code Without Integrity Check vulnerability in Phoenixcontact products A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices. | 6.5 |
| 2023-12-14 | CVE-2023-5592 | Download of Code Without Integrity Check vulnerability in Phoenixcontact Multiprog and Proconos Eclr Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity. | 7.5 |
| 2023-09-13 | CVE-2023-3935 | Out-of-bounds Write vulnerability in multiple products A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system. | 9.8 |