PT-2018-1516 · Phoenix Contact · Fl Switch

Semen Sokolov · Published 2018-02-22 · Updated 2018-06-20 · CVE-2018-10729

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Phoenix Contact FL SWITCH versions 1.0 through 1.33

Description The issue is related to insufficient security mechanisms in the CGI applications of the firmware, allowing a remote attacker to access the contents of configuration files. An unauthenticated user can read the configuration file.

Recommendations For versions 1.0 through 1.33, restrict access to the configuration file to prevent unauthorized reading until a patch is available. Consider implementing additional security measures to protect the configuration files from unauthorized access.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2018-01071

CVE-2018-10729

Affected Products

Fl Switch

References · 8

• https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-10729 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10729 · Vendor Advisory
• https://cert.vde.com/de-de/advisories/vde-2018-005 · Patch
• https://bdu.fstec.ru/vul/2018-01071 · Security Note
• https://cert.vde.com/en-us/advisories/vde-2018-007 · Note
• http://securityfocus.com/bid/104231 · Note
• https://ptsecurity.com/ru-ru/research/threatscape/pt-2018-12 · Note