firmware-workshop

Hands-on Firmware Extraction, Exploration, and Emulation Join us for this hands-on demo of Unblob, the flexible firmware extractor. During this workshop session, we will extract firmware from an EV charger, dig into the firmware, and eventually emulate it so we can interact with the services in...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 Jupicore External Control of Path Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware-update endpoint. The issue results from th...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 BackendURL WebSocket Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3150 devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 ModBus Server Exposed Dangerous Function Denial-of-Service Vulnerability

This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CharxModbusServer, which listens on...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 charx-jupicore Missing Authentication Configuration Modification Vulnerability

This vulnerability allows network-adjacent attackers to modify configuration on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the charx-jupicore REST API, which listens on TCP port 55...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 Insertion of Sensitive Information into Log File Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the generation of log files. The issue results from...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 Race Condition Firewall Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass firewall rules on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firewall rules. The issue results from...

Phoenix Contact CHARX SEC-3000 Authentication Bypass

The vulnerability of the microprogrammed control devices for AC charging stations and wall-mounted charging devices from Phoenix Contact’s CHARX SEC-3000 is related to the absence of authentication procedures. Exploiting this vulnerability could allow an intruder to gain unauthorized access to re...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 OCPP Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the OCPP service. The issue result...

(Pwn2Own) Phoenix Contact CHARX SEC-3100 Config Manager Improper Input Validation Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CharxSystemConfigManager service, which listens on...

(Pwn2Own) Phoenix Contact CHARX SEC-3100 CANopenDevice Null Pointer Dereference Denial-of-Service Vulnerability

This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of CANopenDevice objects. Th...

(Pwn2Own) Phoenix Contact CHARX SEC-3100 CharxUpdateAgent Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CharxUpdateAgent service, which listens on TCP port...

(Pwn2Own) Phoenix Contact CHARX SEC-3100 HomePlug Protocol Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the HomePlug Green PHY Protocol...

(Pwn2Own) Phoenix Contact CHARX SEC-3100 plctool Improper Privilege Management Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3100 devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists with...

(Pwn2Own) Phoenix Contact CHARX SEC-3100 Untrusted Search Path Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3100 devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists with...

PT-2024-21334

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3100 affected versions not specified Description An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a Man-In-The-Middle MITM attack. Charging is not...

PT-2024-21272

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3100 affected versions not specified Description An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected. Recommendations At the moment, the...

PT-2024-21276

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3100 CANopenDevice affected versions not specified Description An unauthenticated remote attacker can disrupt the charging functionality by causing a denial-of-service DoS in the control agent due to access of an...

PT-2024-21275

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3100 affected versions not specified Description An unauthenticated remote attacker can cause a denial of service DoS to the control agent due to an out-of-bounds read, which may prevent or disrupt the charging...

PT-2024-21271

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3100 affected versions not specified Description An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user. Recommendations At...