Phoenixcontact vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2022-22509 In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device conHigh 8.8 · Feb 2, 2022
• CVE-2020-10940 Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.High 7.8 · Mar 27, 2020
• CVE-2020-10939 Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.High 7.8 · Mar 27, 2020
• CVE-2020-9436 PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05High 8.8 · Mar 12, 2020
• CVE-2020-9435 PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05High 7.5 · Mar 12, 2020
• CVE-2018-16994 An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices and Bosch Rexroth S20-ETH-BK and RexroHigh 7.5 · Feb 18, 2020
• CVE-2019-18352 Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using MAC-based port securHigh 8.2 · Feb 18, 2020
• CVE-2020-8768 An issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L before 1.2.3 devices.Critical 9.4 · Feb 17, 2020
• CVE-2019-16675 An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86.High 7.8 · Oct 31, 2019
• CVE-2019-12870 An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86.High 8.8 · Jun 24, 2019
• CVE-2019-12869 An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86.High 8.8 · Jun 24, 2019
• CVE-2019-12871 An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86.High 8.8 · Jun 24, 2019
• CVE-2018-13994 The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is vulnerable to a denial-of-service attack by making more than 120 connections.High 7.5 · May 7, 2019
• CVE-2018-13993 The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is prone to CSRF.High 8.8 · May 7, 2019
• CVE-2018-13992 The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by default.High 8.2 · May 7, 2019
• CVE-2018-13990 The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 is vulnerable to brute-force attacks, because of Improper Restriction of ExcessivHigh 8.6 · May 6, 2019
• CVE-2019-9744 An issue was discovered on PHOENIX CONTACT FL NAT SMCS 8TX, FL NAT SMN 8TX, FL NAT SMN 8TX-M, and FL NAT SMN 8TX-M-DMG devices.High 8.8 · Mar 26, 2019
• CVE-2019-9743 An issue was discovered on PHOENIX CONTACT RAD-80211-XD and RAD-80211-XD/HP-BUS devices.High 8.8 · Mar 26, 2019
• CVE-2019-9201 Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstratedCritical 9.8 · Feb 26, 2019
• CVE-2018-10731 All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when handling very large cookCritical 9 · May 17, 2018
• CVE-2018-10730 All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection.Critical 9.1 · May 17, 2018
• CVE-2018-10728 All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows (a different vulnerability thHigh 8.1 · May 17, 2018
• CVE-2018-5441 An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0.High 7.8 · Jan 30, 2018
• CVE-2017-16743 An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32.Critical 9.8 · Jan 12, 2018
• CVE-2017-5159 An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0.Critical 9.8 · Feb 13, 2017