Summary
An attacker with permission to transfer configuration files to/from the switch or permission to upgrade firmware, is able to execute arbitrary OS shell commands. CGI applications config_transfer.cgi and software_update.cgi are prone to OS command injection through targeted manipulation of their web-request headers.
Details
Impact
If the vulnerability is exploited, the attacker may create their own executable files that could further exploit the integrity of the managed FL SWITCH. For example, the attacker may deny switch network access.
Mitigation
Customers using Phoenix Contact managed FL SWITCH devices with affected firmware versions are recommended to disable the switch Web Agent.
Remediation
Customers using Phoenix Contact managed FL SWITCH devices with affected firmware versions are recommended to update the firmware to version 1.34 or higher which fixes this vulnerability. The updated firmware may be downloaded from the managed switch product page on the Phoenix Contact website.
Vulnerabilities 1
-
Unscored —
All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS co…
Revision history
-
#3
Fix: version space, added distribution
-
#2
Fix: correct certvde domain, added self-reference
-
#1
Initial revision.
References
-
CERT@VDE Security Advisories for Phoenix Contact
https://certvde.com/en/advisories/vendor/phoenixcontact/
-
VDE-2018-004: Phoenix Contact: FL SWITCH 3xxx/4xxx/48xx series through 1.33 allows Command Injection - HTML
https://certvde.com/en/advisories/VDE-2018-004