PT-2024-22284 · Phoenix Contact · Phoenix Contact Charx Sec-3100

Sina Kheirkhah + 1 · Published 2024-05-14 · Updated 2024-07-07 · CVE-2024-28134

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3100 versions up to 1.5.1

Description An unauthenticated remote attacker can extract a session token with a Man-in-the-Middle (MitM) attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained, but the availability can be seriously affected.

Recommendations For Phoenix Contact CHARX SEC-3100 versions up to 1.5.1, upgrade to a patched version as soon as possible to prevent exposure of confidential information. As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2024-28134

ZDI-24-520

Affected Products

Phoenix Contact Charx Sec-3100

References · 5

• https://zerodayinitiative.com/advisories/ZDI-24-520 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-28134 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28134 · Vendor Advisory
• https://cert.vde.com/en/advisories/VDE-2024-019 · Note
• https://twitter.com/oktsec/status/1810119002594652341 · Twitter Post