Phoenixcontact Security Vulnerabilities (CVEs)

An unauthenticated cross-site scripting (XSS) vulnerability in pxc_Dot1xCfg.php allows attackers to trick authenticated users into clicking malicious ...

An unauthenticated cross-site scripting (XSS) vulnerability in port_util.php allows attackers to trick authenticated users into clicking malicious lin...

An unauthenticated cross-site scripting (XSS) vulnerability in pxc_PortCfg.php allows attackers to trick authenticated users into clicking malicious l...

An unauthenticated cross-site scripting (XSS) vulnerability in pxc_portCntr.php allows attackers to trick authenticated users into clicking malicious ...

An unauthenticated cross-site scripting (XSS) vulnerability in pxc_portSfp.php allows attackers to trick authenticated users into clicking malicious l...

This vulnerability allows attackers to use an undocumented UART port on the PCB as a side-channel to gain read access to parts of the device's filesys...

This vulnerability allows attackers to exploit an undocumented UART port on printed circuit boards as a side-channel attack vector to gain root access...

An unauthenticated cross-site scripting (XSS) vulnerability in pxc_portCntr2.php allows attackers to trick authenticated users into sending malicious ...

An unauthenticated cross-site scripting (XSS) vulnerability in pxc_portSecCfg.php allows attackers to trick authenticated users into sending malicious...

An unauthenticated cross-site scripting (XSS) vulnerability in pxc_vlanIntfCfg.php allows attackers to trick authenticated users into sending maliciou...

This vulnerability allows a high-privileged remote attacker with webUI admin access to brute-force the underlying OS root and user passwords due to we...

A low-privileged remote attacker can exploit SSH functionality to execute commands after authentication, causing resource exhaustion that degrades man...

A low-privileged remote attacker can send a webshell request with an empty command containing whitespace, causing the web server to block while waitin...

An unauthenticated cross-site scripting (XSS) vulnerability in dyn_conn.php allows attackers to trick authenticated users into sending malicious POST ...

This vulnerability allows a local attacker with SSH access to escalate privileges to root by exploiting improper input validation in a vulnerable scri...

This vulnerability allows an unauthenticated attacker on the same network to modify system configuration through a specific API endpoint, granting the...

An unauthenticated remote attacker can send malicious MQTT messages to trigger buffer overflow vulnerabilities in charging stations compliant with Ger...

This vulnerability allows low-privileged remote attackers to execute arbitrary operating system commands with root privileges by exploiting improper i...

This vulnerability allows low-privileged remote attackers to modify firewall configuration through environment variables, potentially causing denial o...

A low-privileged remote attacker can modify OSPF service configuration through environment variables OSPF_INTERFACE.SIMPLE_KEY and OSPF_INTERFACE.DIGE...

This vulnerability allows low-privileged remote attackers to modify firewall configuration settings through the FW_PORTFORWARDING.SRC_IP environment v...

This vulnerability allows low-privileged remote attackers to execute arbitrary operating system commands as root on affected mGuard devices. Attackers...

A low-privileged remote attacker can read and write files as root on mGuard devices due to improper input sanitization of the EMAIL_RELAY_PASSWORD var...

An unauthenticated attacker on the local network can exploit the firmware update feature to reset the password for the low-privileged 'user-app' accou...

A local attacker with low privileges can exploit a command injection vulnerability in the OCPP Remote service to execute arbitrary commands and gain r...

A command injection vulnerability in the API allows low-privileged remote attackers to execute arbitrary code as the user-app user due to improper inp...

This vulnerability allows a local low-privileged attacker to exploit an untrusted search path in a CHARX system utility to escalate privileges to root...

CVE-2024-26003 is an out-of-bounds read vulnerability in a charging system control agent that allows unauthenticated remote attackers to cause a denia...

This vulnerability allows unauthenticated remote attackers to perform man-in-the-middle attacks due to lack of encryption for sensitive data in affect...

CVE-2024-25998 allows unauthenticated remote attackers to execute arbitrary commands on OCPP (Open Charge Point Protocol) services due to improper inp...

This vulnerability allows unauthenticated remote attackers to write memory out of bounds via improper input validation in the MQTT stack. It affects s...

CVE-2023-5592 is a critical vulnerability in PHOENIX CONTACT industrial automation software that allows unauthenticated remote attackers to download a...

CVE-2023-46143 is a critical vulnerability in PHOENIX CONTACT classic line PLCs that allows unauthenticated remote attackers to download and modify ap...

This vulnerability allows authenticated remote attackers to execute arbitrary code with root privileges on PHOENIX CONTACT WP 6xxx series web panels b...

This vulnerability allows remote attackers with SNMPv2 write privileges to gain full administrative access to PHOENIX CONTACT WP 6xxx series web panel...

This vulnerability allows remote attackers with knowledge of the SNMPv2 read/write community string to execute arbitrary system commands with root pri...

This vulnerability allows remote attackers with low-privilege access to PHOENIX CONTACT WP 6xxx series web panels to escalate privileges to full devic...

CVE-2023-1109 is a path traversal vulnerability in Phoenix Contacts ENERGY AXC PU Web service that allows authenticated users to read, write, and crea...

This vulnerability affects Phoenix Contact FL MGUARD 1102 and 1105 devices when remote logging is enabled. It causes memory exhaustion due to improper...

This vulnerability allows an attacker to write arbitrary files outside the intended project directory by exploiting improper input validation in PC Wo...

This vulnerability involves undocumented password-protected FTP access to the root directory in certain Phoenix Contact AXL F BK and IL BK devices. At...

This vulnerability allows remote code execution on Phoenix Contact Classic Automation Worx Software Suite programming workstations. Attackers can mani...