Summary
PHOENIX CONTACT FL SWITCH 3xxx series, FL SWITCH 4xxx series, and FL SWITCH 48xx series products running firmware version 1.0 to 1.32 allow unauthenticated users with network access to gain administrative privileges (CVE-2017-16743) and expose information to unauthenticated users in Monitor Mode (CVE-2017-16741).
Details
Impact
CVE-2017-16743: web-service authentication bypass, improper authorization (CWE-285) By crafting HTTP Set-Cookie and POST requests, an unauthenticated attacker with network access may bypass the web-service authentication and gain administrative privileges on the managed switch devices. CVE-2017-16741: information exposure (CWE-200) Any user with network access to a managed switch device may use Monitor Mode to read diagnostic information from the device's web interface without prior authentication in the web GUI. This includes information about model, subnet mask, uptime, and utilisation.
Remediation
Customers using PHOENIX CONTACT FL SWITCH 3xxx series, FL SWITCH 4xxx series, and FL SWITCH 48xx series devices with firmware versions up to 1.32 are recommended to update to firmware version 1.33 or higher, which fixes these vulnerabilities. The updated firmware may be downloaded from the following managed switch product pages on the vendor's website:
| Article No. | Model | Updated Firmware |
|-------------|-----------------------------|-----------------------------------------------------------------------------------------------------|
| 2891030 | FL SWITCH 3005 | [Firmware Update](http://www.phoenixcontact.net/qr/2891030/firmware_update) |
| 2891032 | FL SWITCH 3005T | [Firmware Update](http://www.phoenixcontact.net/qr/2891032/firmware_update) |
| 2891033 | FL SWITCH 3004T-FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891033/firmware_update) |
| 2891034 | FL SWITCH 3004T-FX ST | [Firmware Update](http://www.phoenixcontact.net/qr/2891034/firmware_update) |
| 2891031 | FL SWITCH 3008 | [Firmware Update](http://www.phoenixcontact.net/qr/2891031/firmware_update) |
| 2891035 | FL SWITCH 3008T | [Firmware Update](http://www.phoenixcontact.net/qr/2891035/firmware_update) |
| 2891036 | FL SWITCH 3006T-2FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891036/firmware_update) |
| 2891037 | FL SWITCH 3006T-2FX ST | [Firmware Update](http://www.phoenixcontact.net/qr/2891037/firmware_update) |
| 2891067 | FL SWITCH 3012E-2SFX | [Firmware Update](http://www.phoenixcontact.net/qr/2891067/firmware_update) |
| 2891066 | FL SWITCH 3016E | [Firmware Update](http://www.phoenixcontact.net/qr/2891066/firmware_update) |
| 2891058 | FL SWITCH 3016 | [Firmware Update](http://www.phoenixcontact.net/qr/2891058/firmware_update) |
| 2891059 | FL SWITCH 3016T | [Firmware Update](http://www.phoenixcontact.net/qr/2891059/firmware_update) |
| 2891060 | FL SWITCH 3006T-2FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891060/firmware_update) |
| 2891062 | FL SWITCH 4008T-2SFP | [Firmware Update](http://www.phoenixcontact.net/qr/2891062/firmware_update) |
| 2891061 | FL SWITCH 4008T-2GT-4FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891061/firmware_update) |
| 2891160 | FL SWITCH 4008T-2GT-3FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891160/firmware_update) |
| 2891073 | FL SWITCH 4808E-16FX LC-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891073/firmware_update) |
| 2891080 | FL SWITCH 4808E-16FX SM-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891080/firmware_update) |
| 2891086 | FL SWITCH 4808E-16FX SM ST-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891086/firmware_update) |
| 2891085 | FL SWITCH 4808E-16FX ST-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891085/firmware_update) |
| 2891079 | FL SWITCH 4808E-16FX-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891079/firmware_update) |
| 2891074 | FL SWITCH 4808E-16FX SM LC-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891074/firmware_update) |
| 2891063 | FL SWITCH 4012T 2GT 2FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891063/firmware_update) |
| 2891161 | FL SWITCH 4012T-2GT-2FX ST | [Firmware Update](http://www.phoenixcontact.net/qr/2891161/firmware_update) |
| 2891072 | FL SWITCH 4824E-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891072/firmware_update) |
| 2891102 | FL SWITCH 4800E-24FX-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891102/firmware_update) |
| 2891104 | FL SWITCH 4800E-24FX SM-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891104/firmware_update) |
| 2891120 | FL SWITCH 3012E-2FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891120/firmware_update) |
| 2891119 | FL SWITCH 3012E-2FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891119/firmware_update) |
| 2891162 | FL SWITCH 4000T-8POE-2SFP-R | Please contact your local customer service |
Vulnerabilities 2
-
Unscored —
An Information Exposure issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running…
-
Unscored —
An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products runni…
Revision history
-
#3
Fix: added distribution
-
#2
fixed csaf reference URL
-
#1
Initial revision.
References
-
Phoenix Contact PSIRT
https://www.phoenixcontact.com/de-de/service-und-support/psirt
-
CERT@VDE Security Advisories for Phoenix Contact GmbH & Co. KG
https://certvde.com/en/advisories/vendor/phoenixcontact/
-
VDE-2017-006: PHOENIX CONTACT: FL SWITCH 3xxx/4xxx/48xx series web-service authentication bypass - HTML
https://certvde.com/en/advisories/VDE-2017-006/