Summary
Start sequence for firewall service allows attack during the boot process. Password is reset to default when the device undergoes a firmware upgrade.
Details
Impact
These vulnerabilities may allow an attacker within the network to change the device configuration through an unauthenticated internal service before the firewall is started during boot process. The second vulnerability may allow an local attacker to use the firmware update feature to reset the user-app accounts password to the dafault value that is documented in the product documentation. The user "user-app" has limited access rights.
Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks or
protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to General Recommendation.
Remediation
Phoenix Contact strongly recommends upgrading affected charge controllers to firmware
version 1.6.3 or higher which fixes these vulnerabilities.
Product Description
CHARX control modular AC are charging controllers for mode 3 electric vehicle charging.
Vulnerabilities 2
-
High 8.6
Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.
-
Medium 5.9
Phoenix Contact: Start sequence allows attack during the boot process
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.
Revision history
-
#1.1.2
Update: CWE from CVE-2024-6788, Revision History
-
#1.0.2
Fix: added distribution, quotation mark
-
#1.0.1
Fix: typo in version
-
#1.0.0
initial revision
References
-
2024/00003:
https://phoenixcontact.com/psirt
-
Phoenix Contact advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/phoenixcontact/
-
Phoenix Contact application note
https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf
-
VDE-2024-022: Phoenix Contact: Security Advisory for CHARX-SEC3xxx Charge controllers - HTML
https://certvde.com/en/advisories/VDE-2024-022/