Skip to content
OpenAdvisories
Critical VDE-2024-071 6 CVEs

Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware

Published Dec 9, 2024 · Updated May 22, 2025 · Revision 2

Vendor: Phoenix Contact Product: AXC F 1152 Product: AXC F 2152 Product: AXC F 3152 Product: BPC 9102S Product: EPC 1502 Product: EPC 1522 Product: RFC 4072R Product: RFC 4072S

Summary

Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2024.0.6 LTS

Details

Impact
Availability, integrity, or confidentiality of the PLCnext Control might be compromised by attacks using these vulnerabilities.

Remediation
Update to the latest 2024.0.6 LTS Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer. Check download area for latest Firmware update to be installed on EPC 1502 or EPC 1522.

Vulnerabilities 6

  • Critical 9.8
    CVE-2024-4741

    Use After Free with SSL_free_buffers

    Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, cra…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.1
    CVE-2024-32002 Public exploit EPSS 29%

    Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule'…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.1
    CVE-2024-6387 Public exploit EPSS 100%

    Openssh: regresshion - race condition in ssh allows rce/dos

    A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2024-39894

    OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Su…

    openssh openssh openssh Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2024-2511 EPSS 59%

    Unbounded memory growth with session handling in TLSv1.3

    Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial o…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2024-4603

    Excessive time spent checking DSA keys and parameters

    Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Whe…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Revision history

  1. #2

    Fix: version space, contact details, quotation mark

  2. #1

    Initial

References