CVE-2024-26001

🗓️ 12 Mar 2024 08:12:03Reported by CERTVDEType

An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-26001	12 Mar 202410:26	–	circl
CNNVD	PHOENIX CONTACT CHARX SEC Buffer Error Vulnerability	12 Mar 202400:00	–	cnnvd
Cvelist	CVE-2024-26001 PHOENIX CONTACT: Out of bounds write only memory access	12 Mar 202408:12	–	cvelist
EUVD	EUVD-2024-23297	3 Oct 202520:07	–	euvd
NVD	CVE-2024-26001	12 Mar 202409:15	–	nvd
OSV	CVE-2024-26001	12 Mar 202409:15	–	osv
Prion	Input validation	12 Mar 202409:15	–	prion
Positive Technologies	PT-2024-21274 · Unknown · Mqtt Stack	12 Mar 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-26001	4 Feb 202522:52	–	redhatcve
Vulnrichment	CVE-2024-26001 PHOENIX CONTACT: Out of bounds write only memory access	12 Mar 202408:12	–	vulnrichment

NVD

Vulners

Vulnrichment

Node

phoenixcontact charx_sec-3000_firmwareRange<1.5.1

AND

phoenixcontact charx_sec-3000Match-

Node

phoenixcontact charx_sec-3050_firmwareRange<1.5.1

AND

phoenixcontact charx_sec-3050Match-

Node

phoenixcontact charx_sec-3100_firmwareRange<1.5.1

AND

phoenixcontact charx_sec-3100Match-

Node

phoenixcontact charx_sec-3150_firmwareRange<1.5.1

AND

phoenixcontact charx_sec-3150Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "CHARX SEC-3000",
    "vendor": "PHOENIX CONTACT",
    "versions": [
      {
        "lessThanOrEqual": "1.5.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "CHARX SEC-3050",
    "vendor": "PHOENIX CONTACT",
    "versions": [
      {
        "lessThanOrEqual": "1.5.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "CHARX SEC-3100",
    "vendor": "PHOENIX CONTACT",
    "versions": [
      {
        "lessThanOrEqual": "1.5.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "CHARX SEC-3150",
    "vendor": "PHOENIX CONTACT",
    "versions": [
      {
        "lessThanOrEqual": "1.5.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
cert	www.cert.vde.com/en/advisories/VDE-2024-011

24 Jan 2025 07:15Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.4 - 9.8

EPSS0.00373

SSVC

CWE-787