title: Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use this vulnerability i.e. to open a reverse shell with root privileges.
description: On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges.
problem types: CWE-269 Improper Privilege Management
affected:
{
product: AXC F 1152 (1151412)
vendor: Phoenix Contact
versions:
lessThan: 2021.0 LTS, status: affected, version: unspecified, versionType: custom
}
{
product: AXC F 2152 (2404267)
vendor: Phoenix Contact
versions:
lessThan: 2021.0 LTS, status: affected, version: unspecified, versionType: custom
}
{
product: AXC F 3152 (1069208)
vendor: Phoenix Contact
versions:
lessThan: 2021.0 LTS, status: affected, version: unspecified, versionType: custom
}
{
product: RFC 4072S (1051328
vendor: Phoenix Contact
versions:
lessThan: 2021.0 LTS, status: affected, version: unspecified, versionType: custom
}
{
product: AXC F 2152 Starterkit (1046568)
vendor: Phoenix Contact
versions:
lessThan: 2021.0 LTS, status: affected, version: unspecified, versionType: custom
}
{
product: PLCnext Technology Starterkit (1188165)
vendor: Phoenix Contact
versions:
lessThan: 2021.0 LTS, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
solutions: Phoenix Contact recommends affected users to upgrade to the current Firmware 2021.0 LTS or higher which fixes these vulnerabilities.
workarounds: Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note.