PT-2023-7877 · Phoenix Contact · Phoenix Contact Multiprog+1

Reid Wightman · Published 2023-09-02 · Updated 2023-12-21 · CVE-2023-0757

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) (affected versions not specified)

Description The issue is related to an Incorrect Permission Assignment for Critical Resource, which allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device. This can lead to the execution of arbitrary code and full control over the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2023-08948

CVE-2023-0757

Affected Products

Phoenix Contact Multiprog

Phoenix Contact Proconos Eclr

References · 10

• https://bdu.fstec.ru/vul/2023-08948 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-0757 · Security Note
• https://t.me/cvenotify/63701 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2023-051 · Note
• https://t.me/cvenotify/64691 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1735322347631001815 · Twitter Post
• https://vuldb.com/ru/?id.248032 · Note
• https://debricked.com/vulnerability-database/vulnerability/CVE-2023-0757 · Note
• https://twitter.com/CVEnew/status/1735302400909451625 · Twitter Post
• https://github.com/advisories/GHSA-j2r4-7r3h-j7m5 · Note