Lucene search
CERTVDEVULNRICHMENT:CVE-2024-25998HistoryMar 12, 2024 - 8:11 a.m.
CVE-2024-25998 PHOENIX CONTACT: Command injection in the OCPP Service
2024-03-1208:11:31
CWE-20
CERTVDE
github.com
3
cve-2024-25998
phoenix contact
command injection
ocpp service
improper input validation
CVSS3
7.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
AI Score
7.2
Confidence
Low
SSVC
Exploitation
none
Automatable
yes
Technical Impact
total
An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation.
ADP Affected
[
{
"cpes": [
"cpe:2.3:a:phoenixcontact:charx_sec_3000:*:*:*:*:*:*:*:*"
],
"vendor": "phoenixcontact",
"product": "charx_sec_3000",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "1.5.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:phoenixcontact:charx_sec_3050:*:*:*:*:*:*:*:*"
],
"vendor": "phoenixcontact",
"product": "charx_sec_3050",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "1.5.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:phoenixcontact:charx_sec_3100:*:*:*:*:*:*:*:*"
],
"vendor": "phoenixcontact",
"product": "charx_sec_3100",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "1.5.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:phoenixcontact:charx_sec_3150:*:*:*:*:*:*:*:*"
],
"vendor": "phoenixcontact",
"product": "charx_sec_3150",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "1.5.0"
}
],
"defaultStatus": "unknown"
}
]References
Related
nvd
nvd
CVE-2024-25998
2024-03-12 09:15:08
cve
cve
CVE-2024-25998
2024-03-12 09:15:08
zdi
zdi
prion
prion
Command injection
2024-03-12 09:15:00
cvelist
cvelist
CVE-2024-25998 PHOENIX CONTACT: Command injection in the OCPP Service
2024-03-12 08:11:31
CVSS3
7.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
AI Score
7.2
Confidence
Low
SSVC
Exploitation
none
Automatable
yes
Technical Impact
total
Related for VULNRICHMENT:CVE-2024-25998