PHOENIX CONTACT: Security Advisory for AXL F BK and IL BK products

Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:
Measures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf

Remediation
For the following devices, a firmware update is available that disables the above-mentioned undocumented FTP access. PHOENIX CONTACT recommends upgrading these devices to the latest firmware.

| Article No | Article | Fixed Version | FW Download |
|------------|----------------------|-------------------|-------------------|
| 1068857 | AXL F BK PN TPS XC | FW >1.30, HW 01 | [http://www.phoenixcontact.net/qr/1068857/firmware](#) |
| 2403869 | AXL F BK PN TPS | FW >1.30, HW 02 | [http://www.phoenixcontact.net/qr/2403869/firmware](#) |
| 2688394 | AXL F BK EIP | FW >1.30, HW 05 | [http://www.phoenixcontact.net/qr/2688394/firmware](#) |
| 2702782 | AXL F BK EIP EF | FW >1.30, HW 01 | [http://www.phoenixcontact.net/qr/2702782/firmware](#) |
| 2688459 | AXL F BK ETH | FW >1.30, HW 05 | [http://www.phoenixcontact.net/qr/2688459/firmware](#) |
| 2701949 | AXL F BK ETH XC | FW >1.30, HW 05 | [http://www.phoenixcontact.net/qr/2701949/firmware](#) |
| 2701686 | AXL F BK S3 | FW >1.40, HW 05 | [http://www.phoenixcontact.net/qr/2701686/firmware](#) |

Impact
An attacker who was able to obtain the hard-coded password to FTP access could access the FTP area and read the scrambled monitoring information of the device.