Skip to content
OpenAdvisories
High · 7.8 CVE-2024-28137 EUVD-2024-25284GHSA-9jcm-v2gm-fpx9

PHOENIX CONTACT: privilege escalation due to a TOCTOU vulnerability in the CHARX Series

Published May 14, 2024 · Updated Aug 2, 2024 · Assigned by CERTVDE

Vendor: Phoenix Contact Product: CHARX SEC-3000 Product: CHARX SEC-3050 Product: CHARX SEC-3100 Product: CHARX SEC-3150 Category: ICS / OT

Description

A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability.

Affected products

VendorProductAffectedFixed
PHOENIX CONTACT CHARX SEC-3000 ≤ 1.5.1 —
PHOENIX CONTACT CHARX SEC-3050 ≤ 1.5.1 —
PHOENIX CONTACT CHARX SEC-3100 ≤ 1.5.1 —
PHOENIX CONTACT CHARX SEC-3150 ≤ 1.5.1 —

Advisories 1

References