PT-2019-12129 · Phoenix Contact · Axc F 2152 Starterkit+1

Published 2019-06-18 · Updated 2019-06-20 · CVE-2019-10998

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Phoenix Contact AXC F 2152 versions prior to 2019.0 LTS Phoenix Contact AXC F 2152 STARTERKIT versions prior to 2019.0 LTS

Description An issue allows unlimited physical access to the Programmable Logic Controller (PLC), which may lead to manipulation of SD card data. This SD card manipulation can result in an authentication bypass opportunity.

Recommendations For Phoenix Contact AXC F 2152 versions prior to 2019.0 LTS, update to version 2019.0 LTS or later to resolve the issue. For Phoenix Contact AXC F 2152 STARTERKIT versions prior to 2019.0 LTS, update to version 2019.0 LTS or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-10998

Affected Products

Axc F 2152

Axc F 2152 Starterkit

References · 3

• https://dam-mdc.phoenixcontact.com/asset/156443151564/fa7be4d04c301f18c6cc0e0872193a42/Security_Advisory_AXC_F_2152_FW.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10998 · Security Note