title: Phoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTS
description: Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests.
problem types: CWE-20 Improper Input Validation
affected:
{
product: AXC F
vendor: Phoenix Contact
versions:
lessThan: 2021.0.5 LTS, status: affected, version: AXC F 1152 (1151412), versionType: custom
lessThan: 2021.0.5 LTS, status: affected, version: AXC F 2152 (2404267), versionType: custom
lessThan: 2021.0.5 LTS, status: affected, version: AXC F 3152 (1069208), versionType: custom
lessThan: 2021.0.5 LTS, status: affected, version: AXC F 2152 Starterkit (1046568), versionType: custom
}
{
product: RFC
vendor: Phoenix Contact
versions:
lessThan: 2021.0.5 LTS, status: affected, version: RFC 4072S (1051328), versionType: custom
}
{
product: PLCnext
vendor: Phoenix Contact
versions:
lessThan: 2021.0.5 LTS, status: affected, version: PLCnext Technology Starterkit (1188165), versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
solutions: Phoenix Contact recommends affected users to upgrade to the current Firmware 2021.0.5 LTS or higher which fixes this vulnerability.
workarounds: Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:
Measures to protect network-capable devices with Ethernet connection