PT-2021-20552

Name of the Vulnerable Software and Affected Versions: Phoenix Contact PLCnext control devices versions prior to 2021.0.5 LTS Description: The issue allows for a Denial of Service DoS attack through specially crafted JSON requests. Recommendations: For versions prior to 2021.0.5 LTS, update to...

CVE-2020-12519: Improper Privilege Management

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges...

CVE-2020-12518: Exposure of Sensitive Information to an Unauthorized Actor

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks...

CVE-2020-12521: Improper Input Validation

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack. An attacker can cause failure of system services or a complete reboot...

CVE-2020-12517: Improper Neutralization of Input During Web Page Generation

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website local privilege escalation...

PT-2020-13152

Name of the Vulnerable Software and Affected Versions Phoenix Contact PLCnext Control Devices versions prior to 2021.0 LTS Description The issue allows an attacker to gain knowledge by reading insufficiently protected sensitive information, which can be used to plan further attacks. Recommendatio...

PT-2020-13154

Name of the Vulnerable Software and Affected Versions Phoenix Contact PLCnext Control Devices versions prior to 2021.0 LTS Description A specially crafted LLDP packet may lead to a high system load in the PROFINET stack, causing failure of system services or a complete reboot. Recommendations For...

PT-2020-13153

Name of the Vulnerable Software and Affected Versions Phoenix Contact PLCnext Control Devices versions prior to 2021.0 LTS Description The issue allows an attacker to open a reverse shell with root privileges. Recommendations For versions prior to 2021.0 LTS, update to version 2021.0 LTS or later...

PT-2020-13151

Name of the Vulnerable Software and Affected Versions Phoenix Contact PLCnext Control Devices versions prior to 2021.0 LTS Description The issue allows an authenticated low-privileged user to embed malicious Javascript code, potentially gaining admin rights when an admin user visits the vulnerabl...