PT-2023-7105 · Phoenix Contact · Phoenix Contacts Energy Axc Pu

Published 2023-04-17 · Updated 2023-04-27 · CVE-2023-1109

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Phoenix Contacts ENERGY AXC PU versions (affected versions not specified)

Description The issue is related to a web service vulnerability that allows an authenticated restricted user of the web frontend to access, read, write, and create files throughout the file system using specially crafted URLs via the upload and download functionality. This may lead to full control of the service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-08132

CVE-2023-1109

GHSA-W923-8W64-F5GH

Affected Products

Phoenix Contacts Energy Axc Pu

References · 9

• https://bdu.fstec.ru/vul/2023-08132 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-1109 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1109 · Vendor Advisory
• https://t.me/cvenotify/49141 · Telegram Post
• https://phoenixcontact.com/en-pc/psirt · Note
• https://github.com/advisories/GHSA-w923-8w64-f5gh · Note
• https://cert.vde.com/en/advisories/VDE-2023-003 · Note
• https://t.me/cvenotify/48395 · Telegram Post
• https://t.me/cibsecurity/62263 · Telegram Post