PT-2019-3743 · Phoenix Contact · Pc Worx+2
Publicado
2019-03-06
·
Atualizado
2019-06-27
·
CVE-2019-12869
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
PHOENIX CONTACT PC Worx versions 1.86 and earlier
PHOENIX CONTACT PC Worx Express versions 1.86 and earlier
PHOENIX CONTACT Config+ versions 1.86 and earlier
Description
An issue in the affected software allows a manipulated project file to cause an Out-Of-Bounds Read, potentially leading to Information Disclosure and remote code execution. The attacker must first obtain an original project file, manipulate it, and then exchange it with the original file on the application programming workstation. This could allow a remote attacker to disclose protected information and execute arbitrary code using a managed project file.
Recommendations
For PHOENIX CONTACT PC Worx versions 1.86 and earlier, consider restricting access to project files to minimize the risk of exploitation.
For PHOENIX CONTACT PC Worx Express versions 1.86 and earlier, avoid using potentially manipulated project files until a fix is available.
For PHOENIX CONTACT Config+ versions 1.86 and earlier, as a temporary workaround, consider disabling the use of project files from untrusted sources until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Config+
Pc Worx
Pc Worx Express