PT-2018-1518 · Phoenix Contact · Fl Switch

Semen Sokolov + 1 · Published 2018-02-22 · Updated 2018-06-20 · CVE-2018-10731

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Phoenix Contact FL SWITCH versions 1.0 through 1.33

Description The issue is caused by a buffer overflow in the device's memory, allowing a remote attacker to gain unauthorized access to the device's OS files and execute arbitrary code. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions 1.0 through 1.33, update the firmware to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2018-01073

CVE-2018-10731

Affected Products

Fl Switch

References · 8

• https://cert.vde.com/de-de/advisories/vde-2018-007 · Patch
• https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-10731 · Security Note
• https://bdu.fstec.ru/vul/2018-01073 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10731 · Vendor Advisory
• https://ptsecurity.com/ru-ru/research/threatscape/pt-2018-14 · Note
• https://cert.vde.com/en-us/advisories/vde-2018-007 · Note
• http://securityfocus.com/bid/104231 · Note