Summary
Multiple vulnerabilities have been identified in PHOENIX CONTACT AXC F 2152 with firmware versions 1.x
Details
Impact
see CVEs for details.
General Recommendation
Customers using Phoenix Contact AXC F 2152 are recommended to operate the devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:
'Art.-Nr. 107913: AH EN INDUSTRIAL SECURITY 'Measures to protect network-capable devices with Ethernet connection against unauthorized access'
Remediation
Update to Firmware Release 2019.0 LTS or later.
Update to PLCnext Engineer Release 2019.0 LTS or later.
Update A, 30.08.2019
With Firmware Release 2019.6 an option was added to the web-based
management that allows the user to permanently disable storage of configuration data to the
SD-Card. The device can now be operated without SD-Card and ignores any inserted SD-Card.
We recommend using this new configuration option for application scenarios where physical
access to the device cannot be restricted effectively.
Vulnerabilities 46
-
Critical 9.8
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denia…
-
Critical 9.8CVE-2017-8817 EPSS 11%
The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-o…
-
Critical 9.8CVE-2018-1000120 EPSS 12%
curl FTP path confusion leads to NIL byte out of bounds write
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
-
Critical 9.1
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the da…
-
Critical 9.1
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of s…
-
High 8.8
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact …
-
High 8.1
The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE usin…
-
High 7.5
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of s…
-
High 7.5
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereferenc…
-
High 7.5
The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which…
-
High 7.5
The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allo…
-
Medium 6.5
When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 b…
-
Medium 6.5
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those number…
-
Medium 6.1
Cross-Site Scripting (XSS) in jquery
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
-
Medium 6.1CVE-2016-7103 EPSS 29%
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
-
Medium 5.3
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly…
-
Medium 5.3
OPC UA applications can allow a remote attacker to determine a Server's private key
An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determin…
-
Unscored —CVE-2016-1247 Public exploit
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LT…
-
Unscored —
curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote …
-
Unscored —
The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not veri…
-
Unscored —
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper poin…
-
Unscored —
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper point…
-
Unscored —
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via …
-
Unscored —
The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE usin…
-
Unscored —
libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successf…
-
Unscored —
tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) …
-
Unscored —
tcpdump 4.9.0 has a heap-based buffer over-read in the lldp_print function in print-lldp.c, related to util-print.c.
-
Unscored —
tcpdump 4.9.0 has a heap-based buffer over-read in the pimv1_print function in print-pim.c.
-
Unscored —
tcpdump 4.9.0 has a buffer overflow in the sliplink_print function in print-sl.c.
-
Unscored —CVE-2017-3731 EPSS 57%
Truncated packet could crash via OOB read
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be trigge…
-
Unscored —CVE-2017-3735 EPSS 21%
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This woul…
-
Unscored —CVE-2017-3737 EPSS 79%
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal erro…
-
Unscored —CVE-2017-3738 EPSS 13%
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. N…
-
Unscored —CVE-2017-5334 EPSS 33%
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 a…
-
Unscored —
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote a…
-
Unscored —
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x …
-
Unscored —
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allo…
-
Unscored —
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the …
-
Unscored —CVE-2018-0737 EPSS 12%
Cache timing vulnerability in RSA Key Generation
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in Open…
-
Unscored —
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (h…
-
Unscored —CVE-2018-1000117 Public exploit
Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in …
-
Unscored —
A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker …
-
Unscored —
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an atta…
-
Unscored —
In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may …
-
Unscored —
An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046…
-
Unscored —
An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046…
Revision history
-
#3
Fix: added distribution, status to final, quotation mark
-
#2
Update A
-
#1
Initial revision.
References
-
Phoenix Contact PSIRT
https://www.phoenixcontact.com/de-de/service-und-support/psirt
-
CERT@VDE Security Advisories for Phoenix Contact GmbH & Co. KG
https://certvde.com/en/advisories/vendor/phoenixcontact/
-
VDE-2019-009: PHOENIX CONTACT: Multiple Vulnerabilities in AXC F 2152 - HTML
https://certvde.com/en/advisories/VDE-2019-009/