Command injection

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection...

Authorization

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 allow reading the configuration file by an unauthenticated user...

CVE-2018-10728

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows a different vulnerability than CVE-2018-10731...

CVE-2018-10730

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection...

CVE-2018-10728

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows a different vulnerability than CVE-2018-10731...

CVE-2018-10731

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when handling very large cookies a different vulnerability than CVE-2018-10728...

CVE-2018-10729

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 allow reading the configuration file by an unauthenticated user...

CVE-2018-10728

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows a different vulnerability than CVE-2018-10731...

CVE-2018-10731

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when handling very large cookies a different vulnerability than CVE-2018-10728...

CVE-2018-10728

CVE-2018-10728 affects Phoenix Contact FL SWITCH 3xxx/4xxx/48xxx series (firmware 1.0–1.33 per NVD; 1.0–1.32 per CNVD) with a stack buffer overflow in handling cookies. CNVD entries describe a remote exploit via crafted GET cookies that could overflow a buffer, potentially allowing unauthorized a...

CVE-2018-10729

Phoenix Contact FL SWITCH series (3xxx/4xxx/48xx) running firmware 1.0–1.33 are affected by an information-disclosure vulnerability that allows an unauthenticated attacker to read the device configuration file. The issue is cataloged as CVE-2018-10729; the related ICS/CERT advisory notes informat...

CVE-2018-10730

CVE-2018-10730 affects Phoenix Contact FL SWITCH 3xxx/4xxx/48xx series running firmware 1.0–1.33. The vulnerability is a command injection in the OS shell triggered when transferring configuration files or upgrading firmware. Risk is high (CVSS v3 base 9.1) with remote exploitation possible accor...

CVE-2018-10731

CVE-2018-10731 affects Phoenix Contact FL SWITCH 3xxx/4xxx/48xxx series with firmware 1.0–1.33. It describes a stack buffer overflow when handling very large cookies, potentially enabling remote code execution or denial of service as indicated by CNVD/NVD records. The connected documents provide ...

CVE-2018-10728: Improper Restriction of Operations within the Bounds of a Memory Buffer

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows a different vulnerability than CVE-2018-10731...

CVE-2018-10731: Improper Restriction of Operations within the Bounds of a Memory Buffer

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when handling very large cookies a different vulnerability than CVE-2018-10728...

CVE-2018-10729: Exposure of Sensitive Information to an Unauthorized Actor

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 allow reading the configuration file by an unauthenticated user...

CVE-2018-10730: Improper Neutralization of Special Elements used in an OS Command

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection...

PHOENIX CONTACT FL SWITCH 3xxx/4xxx/48xx Series

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : PHOENIX CONTACT Equipment : FL SWITCH 3xxx/4xxx/48xx Series Vulnerabilities : Command Injection, Information Exposure, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of...

PT-2018-1516

Name of the Vulnerable Software and Affected Versions Phoenix Contact FL SWITCH versions 1.0 through 1.33 Description The issue is related to insufficient security mechanisms in the CGI applications of the firmware, allowing a remote attacker to access the contents of configuration files. An...

PT-2018-1518

Name of the Vulnerable Software and Affected Versions Phoenix Contact FL SWITCH versions 1.0 through 1.33 Description The issue is caused by a buffer overflow in the device's memory, allowing a remote attacker to gain unauthorized access to the device's OS files and execute arbitrary code. The...