title: Phoenix Contact: ProConOs prone to Download of Code Without Integrity Check
description: Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity.
problem types: CWE-494 Download of Code Without Integrity Check
affected:
{
defaultStatus: unaffected
product: MULTIPROG
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: ProConOS eCLR (SDK)
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL