PT-2023-7874 · Phoenix Contact · Phoenix Contact Multiprog+1

Reid Wightman · Published 2023-10-16 · Updated 2023-12-21 · CVE-2023-5592

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) (affected versions not specified)

Description The issue is related to the download of code without integrity checks, allowing an unauthenticated remote attacker to download and execute applications on the device, potentially resulting in a complete loss of integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-494

Related Identifiers

BDU:2023-08945

CVE-2023-5592

Affected Products

Phoenix Contact Multiprog

Phoenix Contact Proconos Eclr

References · 8

• https://bdu.fstec.ru/vul/2023-08945 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5592 · Security Note
• https://cert.vde.com/en/advisories/VDE-2023-054 · Note
• https://twitter.com/VulmonFeeds/status/1735323360081408218 · Twitter Post
• https://twitter.com/CVEnew/status/1735302398812328300 · Twitter Post
• https://t.me/cvenotify/64696 · Telegram Post
• https://vuldb.com/ru/?id.248035 · Note
• https://github.com/advisories/GHSA-f98h-m8p3-7jp3 · Note