Phoenix Contact: Multiple vulnerabilities in the Firmware of CHARX SEC charge controllers
Multiple vulnerabilities have been discovered in the Firmware of CHARX SEC charge controllers. Update: credis have been updated
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-28137US | — | — | ||
A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerab… | ||||
| CVE-2024-28136US | — | — | ||
A local attacker with low privileges can use a command injection vulnerability to gain root
privileges due to improper input validation using the OCPP Remote service. | ||||
| CVE-2024-28135US | — | — | ||
A low privileged remote attacker can use a command injection vulnerability in the API which performs
remote code execution as the user-app user due to improper input validation. Th… | ||||
| CVE-2024-28134US | —OT elevated | — | ||
An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based
management acces… | ||||
| CVE-2024-28133US | — | — | ||
A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root
privileges.… | ||||
references
External citations — patches, advisories, analysis.
- VDE-2024-019: Phoenix Contact: Multiple vulnerabilities in the Firmware of CHARX SEC charge controllers - HTMLself
- CERT@VDE Security Advisories for Phoenix Contact GmbH & Co. KGexternal
- Vendor PSIRTexternal
- VDE-2024-019: Phoenix Contact: Multiple vulnerabilities in the Firmware of CHARX SEC charge controllers - CSAFself
remediations (10)
- Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
- Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
- Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
- Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
- Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
- Fixed
PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
- Fixed
PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
- Fixed
PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
- Fixed
PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
- Fixed
PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan