CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 1CVE-2024-0762 – Potential buffer overflow when handling UEFI variables
https://notcve.org/view.php?id=CVE-2024-0762
Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for select Intel platforms This issue affects: Phoenix SecureCore™ for Intel Kaby Lake: from 4.0.1.1 before 4.0.1.998; Phoenix SecureCore™ for Intel Coffee Lake: from 4.1.0.1 before 4.1.0.562; Phoenix SecureCore™ for Intel Ice Lake: from 4.2.0.1 before 4.2.0.323; Phoenix SecureCore™ for Intel Comet Lake: from 4.2.1.1 before 4.2.1.287; Phoenix SecureCore™ for Intel Tiger Lake: from 4.3.0.1 before 4.3.0.236; Phoenix SecureCore™ for Intel Jasper Lake: from 4.3.1.1 before 4.3.1.184; Phoenix SecureCore™ for Intel Alder Lake: from 4.4.0.1 before 4.4.0.269; Phoenix SecureCore™ for Intel Raptor Lake: from 4.5.0.1 before 4.5.0.218; Phoenix SecureCore™ for Intel Meteor Lake: from 4.5.1.1 before 4.5.1.15. Posible desbordamiento del búfer en el manejo inseguro de variables UEFI en Phoenix SecureCore™ para plataformas Intel seleccionadas. Este problema afecta a: Phoenix SecureCore™ para Intel Kaby Lake: desde 4.0.1.1 antes de 4.0.1.998; Phoenix SecureCore™ para Intel Coffee Lake: desde 4.1.0.1 anterior a 4.1.0.562; Phoenix SecureCore™ para Intel Ice Lake: desde 4.2.0.1 anterior a 4.2.0.323; Phoenix SecureCore™ para Intel Comet Lake: desde 4.2.1.1 anterior a 4.2.1.287; Phoenix SecureCore™ para Intel Tiger Lake: desde 4.3.0.1 anterior a 4.3.0.236; Phoenix SecureCore™ para Intel Jasper Lake: desde 4.3.1.1 anterior a 4.3.1.184; Phoenix SecureCore™ para Intel Alder Lake: desde 4.4.0.1 anterior a 4.4.0.269; Phoenix SecureCore™ para Intel Raptor Lake: desde 4.5.0.1 anterior a 4.5.0.218; Phoenix SecureCore™ para Intel Meteor Lake: desde 4.5.1.1 antes de 4.5.1.15. • https://github.com/tadash10/Detect-CVE-2024-0762 https://eclypsium.com/blog/ueficanhazbufferoverflow-widespread-impact-from-vulnerability-in-popular-pc-and-server-firmware https://news.ycombinator.com/item?id=40747852 https://www.phoenix.com/security-notifications/cve-2024-0762 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35841 – WinFlash Driver Permissions Issue
https://notcve.org/view.php?id=CVE-2023-35841
Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0. IOCTL expuesto con control de acceso insuficiente en el controlador Phoenix WinFlash en Windows permite una escalada de privilegios que permite la modificación del firmware del sistema. Este problema afecta al controlador WinFlash: anterior a 4.5.0.0. • https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html https://jvn.jp/en/vu/JVNVU93886750/index.html https://www.phoenix.com/security-notifications/cve-2023-35841 • CWE-732: Incorrect Permission Assignment for Critical Resource CWE-782: Exposed IOCTL with Insufficient Access Control •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-28137 – PHOENIX CONTACT: privilege escalation due to a TOCTOU vulnerability in the CHARX Series
https://notcve.org/view.php?id=CVE-2024-28137
A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability. Un atacante local con privilegios bajos puede realizar una escalada de privilegios con un script de inicio debido a una vulnerabilidad de TOCTOU. This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3100 charging controllers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the /etc/init.d/user-applications script. By creating a symbolic link, an attacker can abuse the script to change ownership of arbitrary files. • https://cert.vde.com/en/advisories/VDE-2024-019 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-28136 – PHOENIX CONTACT: command injection gains root privileges using the OCPP remote service
https://notcve.org/view.php?id=CVE-2024-28136
A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service. Un atacante local con privilegios bajos puede utilizar una vulnerabilidad de inyección de comandos para obtener privilegios de root debido a una validación de entrada incorrecta mediante el servicio remoto OCPP. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Charger ID parameter to the Get Diagnostics command. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. • https://cert.vde.com/en/advisories/VDE-2024-019 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-28135 – PHOENIX CONTACT: command injection vulnerability in the API of the CHARX Series
https://notcve.org/view.php?id=CVE-2024-28135
A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected. Un atacante remoto con pocos privilegios puede utilizar una vulnerabilidad de inyección de comandos en la API que realiza la ejecución remota de código como usuario de la aplicación debido a una validación de entrada incorrecta. La confidencialidad se ve parcialmente afectada. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3100 devices. • https://cert.vde.com/en/advisories/VDE-2024-019 • CWE-20: Improper Input Validation •