title: Phoenix Contact ProConOS prone to Incorrect Permission Assignment for Critical Resource
description: Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.
problem types: CWE-732 Incorrect Permission Assignment for Critical Resource
affected:
{
defaultStatus: unaffected
product: MULTIPROG
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: ProConOS eCLR (SDK)
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL