CVE-2024-28133
📋 TL;DR
This vulnerability allows a local low-privileged attacker to exploit an untrusted search path in a CHARX system utility to escalate privileges to root. It affects systems running vulnerable versions of CHARX software where local users have access to the utility. The attack requires local access to the system.
💻 Affected Systems
- CHARX system utility
📦 What is this software?
Charx Sec 3000 Firmware by Phoenixcontact
Charx Sec 3050 Firmware by Phoenixcontact
Charx Sec 3100 Firmware by Phoenixcontact
Charx Sec 3150 Firmware by Phoenixcontact
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root privileges, allowing attacker to install persistent malware, access all data, and pivot to other systems.
Likely Case
Local privilege escalation leading to unauthorized administrative access on affected systems.
If Mitigated
Limited impact if proper access controls restrict local user accounts and privilege separation is enforced.
🎯 Exploit Status
Exploitation requires local access and low privileges; search path vulnerabilities are typically straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://cert.vde.com/en/advisories/VDE-2024-019
Restart Required: Yes
Instructions:
1. Check vendor advisory for patched version. 2. Update CHARX utility to patched version. 3. Restart affected services or system as required.
🔧 Temporary Workarounds
Restrict CHARX utility permissions
linuxRemove execute permissions for non-privileged users on the vulnerable CHARX utility
chmod 750 /path/to/charx/utility
Implement strict PATH environment control
linuxControl the PATH environment variable for users to prevent untrusted directory inclusion
export PATH=/usr/bin:/bin:/usr/sbin:/sbin
🧯 If You Can't Patch
- Implement strict access controls to limit local user accounts
- Monitor for privilege escalation attempts and unusual root activity
🔍 How to Verify
Check if Vulnerable:
Check if CHARX utility is installed and accessible to low-privileged users: ls -la /path/to/charx/utilityCheck Version:
/path/to/charx/utility --version or check package managerVerify Fix Applied:
Verify CHARX utility version matches patched version from vendor advisory and permissions are restricted📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- CHARX utility execution by non-privileged users
- Failed sudo/su attempts followed by successful root access
Network Indicators:
- None - local exploitation only
SIEM Query:
source="auth.log" AND (event="privilege escalation" OR process="charx")