A. Resanovic

**Name of the Vulnerable Software and Affected Versions** PHOENIX CONTACT TC ROUTER versions prior to 2.07.2 PHOENIX CONTACT TC CLOUD CLIENT versions prior to 2.07.2 PHOENIX CONTACT CLOUD CLIENT 1101T-TX/TX versions prior to 2.06.10 **Description** The issue allows an unauthenticated remote attacker to use a reflective XSS within the license viewer page of the devices to execute code in the context of the user's browser. This is due to the lack of protection measures for the web page structure. **Recommendations** For PHOENIX CONTACT TC ROUTER versions prior to 2.07.2, update to version 2.07.2 or later. For PHOENIX CONTACT TC CLOUD CLIENT versions prior to 2.07.2, update to version 2.07.2 or later. For PHOENIX CONTACT CLOUD CLIENT 1101T-TX/TX versions prior to 2.06.10, update to version 2.06.10 or later. As a temporary workaround, consider restricting access to the license viewer page until a patch is available.

**Name of the Vulnerable Software and Affected Versions** PHOENIX CONTACT TC ROUTER versions prior to 2.07.2 PHOENIX CONTACT TC CLOUD CLIENT versions prior to 2.07.2 PHOENIX CONTACT CLOUD CLIENT 1101T-TX/TX versions prior to 2.06.10 **Description** The issue is related to the incorrect restriction of XML links to external objects in PHOENIX CONTACT's TC ROUTER and TC CLOUD CLIENT. An authenticated remote attacker with admin privileges could upload a crafted XML file, causing a denial-of-service. **Recommendations** For PHOENIX CONTACT TC ROUTER versions prior to 2.07.2, update to version 2.07.2 or later. For PHOENIX CONTACT TC CLOUD CLIENT versions prior to 2.07.2, update to version 2.07.2 or later. For PHOENIX CONTACT CLOUD CLIENT 1101T-TX/TX versions prior to 2.06.10, update to version 2.06.10 or later.

**Name of the Vulnerable Software and Affected Versions** Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 **Description** The issue is related to a Stored Cross-Site Scripting vulnerability. This vulnerability can be triggered by authenticated users in the `device name` field of the web-interface. The vulnerability exists due to inadequate protection of the web page structure, which may allow a remote attacker to conduct cross-site scripting attacks. **Recommendations** For Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21, consider disabling the web-interface or restricting access to the `device name` field until a patch is available. Avoid using the `device name` field in the web-interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 **Description** The issue is related to a Stored Cross-Site Scripting vulnerability. This vulnerability can be triggered by authenticated users in the `ping` tool of the web-interface. The vulnerability exists due to the lack of protection measures for the web page structure, allowing a remote attacker to conduct cross-site scripting attacks using the `ping` tool. **Recommendations** For Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21, consider disabling the `ping` tool in the web-interface as a temporary workaround until a patch is available. Restrict access to the web-interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.