CVE-2018-10728

CVE-2018-10728 affects Phoenix Contact FL SWITCH 3xxx/4xxx/48xxx series (firmware 1.0–1.33 per NVD; 1.0–1.32 per CNVD) with a stack buffer overflow in handling cookies. CNVD entries describe a remote exploit via crafted GET cookies that could overflow a buffer, potentially allowing unauthorized a...

CVE-2018-10729

Phoenix Contact FL SWITCH series (3xxx/4xxx/48xx) running firmware 1.0–1.33 are affected by an information-disclosure vulnerability that allows an unauthenticated attacker to read the device configuration file. The issue is cataloged as CVE-2018-10729; the related ICS/CERT advisory notes informat...

CVE-2018-10731

CVE-2018-10731 affects Phoenix Contact FL SWITCH 3xxx/4xxx/48xxx series with firmware 1.0–1.33. It describes a stack buffer overflow when handling very large cookies, potentially enabling remote code execution or denial of service as indicated by CNVD/NVD records. The connected documents provide ...

CVE-2018-10730

CVE-2018-10730 affects Phoenix Contact FL SWITCH 3xxx/4xxx/48xx series running firmware 1.0–1.33. The vulnerability is a command injection in the OS shell triggered when transferring configuration files or upgrading firmware. Risk is high (CVSS v3 base 9.1) with remote exploitation possible accor...

PHOENIX CONTACT FL SWITCH 3xxx/4xxx/48xx Series

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : PHOENIX CONTACT Equipment : FL SWITCH 3xxx/4xxx/48xx Series Vulnerabilities : Command Injection, Information Exposure, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of...

phoenix-wind.com XSS vulnerability

Open Bug Bounty ID: OBB-614716 Description| Value ---|--- Affected Website:| phoenix-wind.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

phoenix.edu XSS vulnerability

Open Bug Bounty ID: OBB-607446 Description| Value ---|--- Affected Website:| phoenix.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Arbitrary Code Execution Vulnerability in the HTML5 Responsive Website Building System of Huizhou Fire Phoenix Network Technology Co.

Huizhou Fire Phoenix Network Technology Co., Ltd. provides one-stop website production, website promotion, APP development, WeChat development, data analysis, software development, dynamic creative, cell phone website, Taobao store permanent code decoration, FLASH animation, to program developmen...

CVE-2016-8371

The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled...

CVE-2016-8380

The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication...

CVE-2016-8366

Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by the user. The password macro can be configured in a way that the password is stored and transferred in clear text...

Authentication flaw

The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication...

Default credentials

Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by the user. The password macro can be configured in a way that the password is stored and transferred in clear text...

CVE-2016-8371

The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled...

CVE-2016-8371

CVE-2016-8371 affects Phoenix Contact ILC PLCs where the web server can be reached without authentication even when an authentication mechanism is enabled. The issue is described across multiple sources as an improper authentication vulnerability that could allow unauthorized access to the PLC’s ...

CVE-2016-8380

CVE-2016-8380 affects Phoenix Contact ILC PLCs. The web server exposes read and write access to PLC variables without authentication, constituting an improper authentication vulnerability. The impact is unauthorized access to PLC data and potential manipulation of tag values, as corroborated by m...

CVE-2016-8380

The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication...

CVE-2016-8366

CVE-2016-8366 affects Phoenix Contact ILC PLCs with WebVisit. The vulnerability arises from a password macro where credentials can be stored and transferred in clear text, enabling potential exposure of user passwords via the HMI protection mechanism. Connected documents confirm the issue is tied...

CVE-2016-8366

Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by the user. The password macro can be configured in a way that the password is stored and transferred in clear text...

PT-2018-14: Buffer Overflow in PHOENIX CONTACT FL SWITCH

The specialists of the Positive Research center have detected a Buffer Overflow vulnerability in PHOENIX CONTACT FL SWITCH. A buffer overflow vulnerability in Phoenix Contact managed FL SWITCH due to improper handling of very large cookies allows attackers to obtain unauthorized access to the...