Summary
The user management of the FL SWITCH 2xxx family of devices implements access rights based on roles and permission groups. An unprivileged user logged in via the SSH CLI is assigned to the admin role independent of his configured access role enabling full access to the device configuration (CWE-266 - Incorrect Privilege Assignment).
User Management via SSH was first introduced with firmware version 3.00. Firmware versions other than 3.00 are not affected by this vulnerability.
Details
Impact
An attacker could elevate his privileges and take over control of the device.
Mitigation
We recommend disabling the login via SSH on devices running firmware version 3.00. If access to the CLI is required and an encrypted connection is not necessary in the specific application, the unencrypted Telnet service may be utilized, which is not affected by this vulnerability.
Remediation
Phoenix Contact strongly recommends affected users to upgrade to the current Firmware 3.10 or higher which fixes this vulnerability.
Vulnerabilities 1
-
High 8.8
PHOENIX CONTACT: FL SWITCH 2xxx series incorrect privilege assignment
In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration.
Revision history
-
#2
Fix: added distribution
-
#1
Initial revision.
References
-
PHOENIX CONTACT PSIRT
https://phoenixcontact.com/psirt
-
CERT@VDE Security Advisories for PHOENIX CONTACT
https://certvde.com/en/advisories/vendor/phoenixcontact/
-
VDE-2022-001: PHOENIX CONTACT: FL SWITCH 2xxx series incorrect privilege assignment - HTML
https://certvde.com/en/advisories/VDE-2022-001/