CVE-2023-1109

HIGH

8.8

Beschreibung

In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service.

CVE Details

CVSS v3.1 Bewertung8.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht4/17/2023

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

phoenixcontact:energy_axc_puphoenixcontact:infoboxphoenixcontact:infobox_firmwarephoenixcontact:smartrtu_axc_igphoenixcontact:smartrtu_axc_ig_firmwarephoenixcontact:smartrtu_axc_sgphoenixcontact:smartrtu_axc_sg_firmware

Schwachen (CWE)

CWE-22

Referenzen

https://cert.vde.com/en/advisories/VDE-2023-003/(info@cert.vde.com)

https://github.com/advisories/GHSA-w923-8w64-f5gh(nvd@nist.gov)

https://cert.vde.com/en/advisories/VDE-2023-003/(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.