Skip to content
OpenAdvisories
Critical VDE-2023-017 2 CVEs

Phoenix Contact: Multiple vulnerabilities in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devices

Published Aug 8, 2023 · Updated May 22, 2025 · Revision 3

Vendor: Phoenix Contact Product: CLOUD CLIENT 1101T-TX/TX Product: TC CLOUD CLIENT 1002-4G Product: TC CLOUD CLIENT 1002-4G ATT Product: TC CLOUD CLIENT 1002-4G VZW Product: TC ROUTER 3002T-4G Product: TC ROUTER 3002T-4G ATT Product: TC ROUTER 3002T-4G VZW

Summary

Two vulnerabilities have been discovered in the firmware of TC ROUTER and TC CLOUD CLIENT devices.

Update A, 2024-08-12

Added a summary text
Added details to impact

Details

Impact
CVE-2023-3526

An attacker could embed a link on a page controlled by him that includes malicious scripts and points to the license viewer page. These scripts are executed in a victim's browser when they open the page containing the vulnerable field.

CVE-2023-3569

An authenticated attacker could use the file upload function to upload a crafted XML to cause a denial of service.

Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note.
Measures to protect network-capable devices with Ethernet connection

Remediation
Phoenix Contact strongly recommends updating to the latest available firmware version, which fixes these vulnerabilities.

Vulnerabilities 2

Revision history

  1. #3

    Fix: quotation mark

  2. #2

    Update A

  3. #1

    Initial revision.

References