PT-2019-9015

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 through 1.34 Description The WebUI of the affected devices allows for plaintext transmission of user credentials by default, which can be done over HTTP. Recommendations For versions 1.0...

PT-2019-9014

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 through 1.34 Description The WebUI of the affected devices leaks private information in firmware images. Recommendations For versions 1.0 through 1.34, consider restricting access to the...

PT-2019-9016

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 through 1.34 Description The WebUI of the affected devices is prone to CSRF, which could potentially allow unauthorized actions to be performed. Recommendations For versions 1.0 through...

PT-2019-9017

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 through 1.34 Description The WebUI of the affected device is susceptible to a denial-of-service attack. This can be achieved by establishing more than 120 connections. Recommendations For...

CVE-2018-13993: Cross-Site Request Forgery (CSRF)

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is prone to CSRF...

CVE-2018-13994: Uncontrolled Resource Consumption

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is vulnerable to a denial-of-service attack by making more than 120 connections...

CVE-2018-13991: Exposure of Sensitive Information to an Unauthorized Actor

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 leaks private information in firmware images...

CVE-2018-13992: Missing Encryption of Sensitive Data

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission HTTP of user credentials by default...

PT-2019-9013

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 Description The WebUI of the affected device is susceptible to brute-force attacks due to improper restriction of excessive authentication attempts. This allows attackers to...

CVE-2018-13990: Improper Authentication

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 is vulnerable to brute-force attacks, because of Improper Restriction of Excessive Authentication Attempts...

CVE-2018-10729: Exposure of Sensitive Information to an Unauthorized Actor

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 allow reading the configuration file by an unauthenticated user...

CVE-2018-10730: Improper Neutralization of Special Elements used in an OS Command

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection...

CVE-2018-10728: Improper Restriction of Operations within the Bounds of a Memory Buffer

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows a different vulnerability than CVE-2018-10731...

CVE-2018-10731: Improper Restriction of Operations within the Bounds of a Memory Buffer

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when handling very large cookies a different vulnerability than CVE-2018-10728...

PT-2018-1517

Name of the Vulnerable Software and Affected Versions Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products versions 1.0 through 1.33 Description The issue is related to OS command injection due to the lack of neutralization of special elements in OS command inputs. This can allow a remote...

CVE-2017-16741

An Information Exposure issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to use Monitor Mode on the device to read diagnostic information...

CVE-2017-16741: Exposure of Sensitive Information to an Unauthorized Actor

An Information Exposure issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to use Monitor Mode on the device to read diagnostic information...

PT-2018-1007

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products versions 1.0 through 1.32 Description An issue with improper authorization was found, allowing a remote unauthenticated attacker to craft special HTTP requests to bypass web-servi...

PT-2017-3434

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products versions 1.0 through 1.32 Description An Information Exposure issue allows a remote unauthenticated attacker to use Monitor Mode on the device to read diagnostic information. The...