Phoenixcontact: Security Vulnerabilities
An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files.
CVSS Score
7.8
EPSS Score
0.001
Published
2024-03-12
An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only.
CVSS Score
5.3
EPSS Score
0.002
Published
2024-03-12
An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation.
CVSS Score
9.8
EPSS Score
0.024
Published
2024-03-12
An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user.
CVSS Score
5.3
EPSS Score
0.006
Published
2024-03-12
An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected.
CVSS Score
5.3
EPSS Score
0.001
Published
2024-03-12
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity.
CVSS Score
7.5
EPSS Score
0.001
Published
2023-12-14
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.
CVSS Score
7.5
EPSS Score
0.002
Published
2023-12-14
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.
CVSS Score
6.5
EPSS Score
0.0
Published
2023-12-14
Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.
CVSS Score
9.8
EPSS Score
0.008
Published
2023-12-14
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.
CVSS Score
9.8
EPSS Score
0.008
Published
2023-12-14