Summary
PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2.
This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities.
Firmware components in version 2021.06 had already been updated. For the 2022.0 LTS version more firmware components have been updated implicitly fixing the vulnerabilities listed. The vulnerabilities listed above have not been individually verified in terms of actual impact and/or limitations in combination with the affected products listed. The current LTS release 2022.0 LTS contains updates of integrated third-party libraries, SDKs and other third-party software to address these issues nevertheless.
UPDATE A (April 4th, 2022): Added RFC 4072 (Art. No. 1051328) and fixed affected version of AXC F 3152
Details
Impact
Availability, integrity, or confidentiality of the AXC F x152 might be compromised by attacks using these vulnerabilities. Please consult the CVE-IDs for vulnerability details.
Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection
Remediation
**Update to Firmware Release 2022.0.3 LTS or higher:**
- AXC F 2152 (2404267) [Download](http://www.phoenixcontact.net/qr/2404267/firmware)
- AXC F 1152 (1151412) [Download](http://www.phoenixcontact.net/qr/1151412/firmware)
- AXC F 3152 (1069208) Not yet released
**Update to PLCnext Engineer Release 2022.0.1 LTS or higher.**
Vulnerabilities 60
-
Critical 9.8
A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory…
-
Critical 9.8
SM2 Decryption Buffer Overflow
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" paramet…
-
Critical 9.8CVE-2022-22822 Public exploit
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8CVE-2022-23852 Public exploit
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML…
-
Critical 9.1
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (i…
-
High 8.8CVE-2021-3518 EPSS 22%
Nokogiri Implements libxml2 version vulnerable to use-after-free
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, an…
-
High 8.8CVE-2021-45960 Public exploit
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…
-
High 8.8
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.6CVE-2021-3517 EPSS 17%
Nokogiri contains libxml Out-of-bounds Write vulnerability
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds …
-
High 8.1
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Call…
-
High 8.1CVE-2021-46143 Public exploit
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
-
High 8.0
malicious repositories can execute remote code while cloning
Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed w…
-
High 7.8CVE-2019-18276 Public exploit
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run wi…
-
High 7.8
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead t…
-
High 7.5CVE-2021-22926 EPSS 15%
libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `C…
-
High 7.5
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or F…
-
High 7.5CVE-2022-23990 Public exploit
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
-
High 7.4
Read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
Medium 6.5
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arb…
-
Medium 6.5
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided…
-
Medium 5.9
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS …
-
Medium 5.9
Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used …
-
Medium 5.5
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …
-
Medium 5.3CVE-2016-20012 Public exploit
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key…
-
Medium 5.3
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURL…
-
Medium 5.3
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used…
-
Medium 5.3
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA…
-
Medium 4.8
The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irre…
-
Low 3.1
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TEL…
-
Unscored —CVE-2019-17498 Public exploit
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds ch…
-
Unscored —
net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk r…
-
Unscored —CVE-2020-10543 EPSS 11%
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifier…
-
Unscored —
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A craf…
-
Unscored —
regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_…
-
Unscored —
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data o…
-
Unscored —
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if…
-
Unscored —
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password…
-
Unscored —
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input…
-
Unscored —
A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption …
-
Unscored —
A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, E…
-
Unscored —
When curl is instructed to get content using the metalink feature, and a user name and password are used to download th…
-
Unscored —
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from …
-
Unscored —
A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could u…
-
Unscored —
git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may re…
-
Unscored —
The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS si…
-
Unscored —
GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffe…
-
Unscored —
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authentica…
-
Unscored —
The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL point…
Revision history
-
#3
Fix: added distribution, quotation mark
-
#2
Update A
-
#1
Initial revision.
References
-
PHOENIX CONTACT PSIRT
https://phoenixcontact.com/psirt
-
CERT@VDE Security Advisories for PHOENIX CONTACT
https://certvde.com/en/advisories/vendor/phoenixcontact/
-
VDE-2022-010: PHOENIX CONTACT: Multiple Linux component vulnerabilities fixed in latest AXC F x152 LTS release - HTML
https://certvde.com/en/advisories/VDE-2022-010/