Critical ICSA-23-250-02 2 CVEs

Phoenix Contact TC ROUTER and TC CLOUD CLIENT

Published Sep 7, 2023 · Updated Sep 7, 2023

Vendor: Phoenix Contact Product: CLOUD CLIENT 1101T-TX/TX Product: TC CLOUD CLIENT 1002-4G Product: TC CLOUD CLIENT 1002-4G ATT Product: TC CLOUD CLIENT 1002-4G VZW Product: TC ROUTER 3002T-4G Product: TC ROUTER 3002T-4G ATT Product: TC ROUTER 3002T-4G VZW

Summary

Successful exploitation of this these vulnerabilities could execute code in the context of the user's browser or cause a denial of service.

Vulnerabilities 2

Critical 9.6

CVE-2023-3526

PHOENIX CONTACT: Cross-site Scripting vulnerability in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devices

In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute …

Phoenix Contact CLOUD CLIENT 1101T-TX/TX TC ROUTER 3002T-4G TC ROUTER 3002T-4G ATT ICS / OT

Aug 8, 2023
Medium 4.9

CVE-2023-3569

PHOENIX CONTACT: Denial-of-Service due to malicious XML files in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT

In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload a crafted XML file which causes a denial-of-service.

Phoenix Contact TC ROUTER 3002T-4G TC ROUTER 3002T-4G ATT TC CLOUD CLIENT 1002-4G ATT ICS / OT

Aug 8, 2023

Revision history

2023-09-07 #1
Initial Publication

References

ICSA Advisory ICSA-23-250-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-02
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B