CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2024-26000 – PHOENIX CONTACT: Out of bounds read only memory access
https://notcve.org/view.php?id=CVE-2024-26000
An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization. Un atacante remoto no autenticado puede leer la memoria fuera de los límites debido a una validación de entrada incorrecta en la pila MQTT. El ataque de fuerza bruta no siempre tiene éxito debido a la aleatorización de la memoria. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Phoenix Contact CHARX SEC-3100 devices. • https://cert.vde.com/en/advisories/VDE-2024-011 • CWE-20: Improper Input Validation •
CVSS: 8.4EPSS: 0%CPEs: 4EXPL: 0CVE-2024-25999 – PHOENIX CONTACT: Privilege escalation in the OCPP agent service
https://notcve.org/view.php?id=CVE-2024-25999
An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service. Un atacante local no autenticado puede realizar una escalada de privilegios debido a una validación de entrada incorrecta en el servicio del agente OCPP. This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3100 charging controllers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the charx_pack_logs script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. • https://cert.vde.com/en/advisories/VDE-2024-011 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-25998 – PHOENIX CONTACT: Command injection in the OCPP Service
https://notcve.org/view.php?id=CVE-2024-25998
An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation. Un atacante remoto no autenticado puede realizar una inyección de comando en el servicio OCPP con privilegios limitados debido a una validación de entrada incorrecta. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the location parameter of the UpdateFirmwareRequest command. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. • https://cert.vde.com/en/advisories/VDE-2024-011 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-25997 – PHOENIX CONTACT: Log injection in CHARX Series
https://notcve.org/view.php?id=CVE-2024-25997
An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected. Un atacante remoto no autenticado puede realizar una inyección de registro debido a una validación de entrada incorrecta. Sólo un determinado archivo de registro se ve afectado. This vulnerability allows network-adjacent attackers to injection malicious content into log files on affected installations of Phoenix Contact CHARX SEC-3100 devices. • https://cert.vde.com/en/advisories/VDE-2024-011 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-25996 – PHOENIX CONTACT: Remote code execution due to an origin validation error in CHARX Series
https://notcve.org/view.php?id=CVE-2024-25996
An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user. Un atacante remoto no autenticado puede realizar una ejecución remota de código debido a un error de validación de origen. El acceso está limitado al usuario del servicio. This vulnerability allows network-adjacent attackers to bypass firewall rules and access another interface on affected installations of Phoenix Contact CHARX SEC-3100 devices. • https://cert.vde.com/en/advisories/VDE-2024-011 • CWE-346: Origin Validation Error •