PHOENIX CONTACT: FL SWITCH 3xxx/4xxx/48xx series web-service authentication bypass
PHOENIX CONTACT FL SWITCH 3xxx series, FL SWITCH 4xxx series, and FL SWITCH 48xx series products running firmware version 1.0 to 1.32 allow unauthenticated users with network access to gain administrative privileges (CVE-2017-16743) and expose information to unauthenticated users in Monitor Mode (CVE-2017-16741).
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-16743US | critical9.8OT elevated | — | ||
An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated att… | ||||
| CVE-2017-16741US | medium5.3 | — | ||
An Information Exposure issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attac… | ||||
references
External citations — patches, advisories, analysis.
- VDE-2017-006: PHOENIX CONTACT: FL SWITCH 3xxx/4xxx/48xx series web-service authentication bypass - HTMLself
- CERT@VDE Security Advisories for Phoenix Contact GmbH & Co. KGexternal
- VDE-2017-006: PHOENIX CONTACT: FL SWITCH 3xxx/4xxx/48xx series web-service authentication bypass - CSAFself
- Phoenix Contact PSIRTexternal
remediations (2)
- Fixed
Customers using PHOENIX CONTACT FL SWITCH 3xxx series, FL SWITCH 4xxx series, and FL SWITCH 48xx series devices with firmware versions up to 1.32 are recommended to update to firmware version 1.33 or higher, which fixes these vulnerabilities. The updated firmware may be downloaded from the following managed switch product pages on the vendor's website: | Article No. | Model | Updated Firmware | |-------------|-----------------------------|-----------------------------------------------------------------------------------------------------| | 2891030 | FL SWITCH 3005 | [Firmware Update](http://www.phoenixcontact.net/qr/2891030/firmware_update) | | 2891032 | FL SWITCH 3005T | [Firmware Update](http://www.phoenixcontact.net/qr/2891032/firmware_update) | | 2891033 | FL SWITCH 3004T-FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891033/firmware_update) | | 2891034 | FL SWITCH 3004T-FX ST | [Firmware Update](http://www.phoenixcontact.net/qr/2891034/firmware_update) | | 2891031 | FL SWITCH 3008 | [Firmware Update](http://www.phoenixcontact.net/qr/2891031/firmware_update) | | 2891035 | FL SWITCH 3008T | [Firmware Update](http://www.phoenixcontact.net/qr/2891035/firmware_update) | | 2891036 | FL SWITCH 3006T-2FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891036/firmware_update) | | 2891037 | FL SWITCH 3006T-2FX ST | [Firmware Update](http://www.phoenixcontact.net/qr/2891037/firmware_update) | | 2891067 | FL SWITCH 3012E-2SFX | [Firmware Update](http://www.phoenixcontact.net/qr/2891067/firmware_update) | | 2891066 | FL SWITCH 3016E | [Firmware Update](http://www.phoenixcontact.net/qr/2891066/firmware_update) | | 2891058 | FL SWITCH 3016 | [Firmware Update](http://www.phoenixcontact.net/qr/2891058/firmware_update) | | 2891059 | FL SWITCH 3016T | [Firmware Update](http://www.phoenixcontact.net/qr/2891059/firmware_update) | | 2891060 | FL SWITCH 3006T-2FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891060/firmware_update) | | 2891062 | FL SWITCH 4008T-2SFP | [Firmware Update](http://www.phoenixcontact.net/qr/2891062/firmware_update) | | 2891061 | FL SWITCH 4008T-2GT-4FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891061/firmware_update) | | 2891160 | FL SWITCH 4008T-2GT-3FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891160/firmware_update) | | 2891073 | FL SWITCH 4808E-16FX LC-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891073/firmware_update) | | 2891080 | FL SWITCH 4808E-16FX SM-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891080/firmware_update) | | 2891086 | FL SWITCH 4808E-16FX SM ST-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891086/firmware_update) | | 2891085 | FL SWITCH 4808E-16FX ST-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891085/firmware_update) | | 2891079 | FL SWITCH 4808E-16FX-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891079/firmware_update) | | 2891074 | FL SWITCH 4808E-16FX SM LC-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891074/firmware_update) | | 2891063 | FL SWITCH 4012T 2GT 2FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891063/firmware_update) | | 2891161 | FL SWITCH 4012T-2GT-2FX ST | [Firmware Update](http://www.phoenixcontact.net/qr/2891161/firmware_update) | | 2891072 | FL SWITCH 4824E-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891072/firmware_update) | | 2891102 | FL SWITCH 4800E-24FX-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891102/firmware_update) | | 2891104 | FL SWITCH 4800E-24FX SM-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891104/firmware_update) | | 2891120 | FL SWITCH 3012E-2FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891120/firmware_update) | | 2891119 | FL SWITCH 3012E-2FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891119/firmware_update) | | 2891162 | FL SWITCH 4000T-8POE-2SFP-R | Please contact your local customer service |
- Fixed
Customers using PHOENIX CONTACT FL SWITCH 3xxx series, FL SWITCH 4xxx series, and FL SWITCH 48xx series devices with firmware versions up to 1.32 are recommended to update to firmware version 1.33 or higher, which fixes these vulnerabilities. The updated firmware may be downloaded from the following managed switch product pages on the vendor's website: | Article No. | Model | Updated Firmware | |-------------|-----------------------------|-----------------------------------------------------------------------------------------------------| | 2891030 | FL SWITCH 3005 | [Firmware Update](http://www.phoenixcontact.net/qr/2891030/firmware_update) | | 2891032 | FL SWITCH 3005T | [Firmware Update](http://www.phoenixcontact.net/qr/2891032/firmware_update) | | 2891033 | FL SWITCH 3004T-FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891033/firmware_update) | | 2891034 | FL SWITCH 3004T-FX ST | [Firmware Update](http://www.phoenixcontact.net/qr/2891034/firmware_update) | | 2891031 | FL SWITCH 3008 | [Firmware Update](http://www.phoenixcontact.net/qr/2891031/firmware_update) | | 2891035 | FL SWITCH 3008T | [Firmware Update](http://www.phoenixcontact.net/qr/2891035/firmware_update) | | 2891036 | FL SWITCH 3006T-2FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891036/firmware_update) | | 2891037 | FL SWITCH 3006T-2FX ST | [Firmware Update](http://www.phoenixcontact.net/qr/2891037/firmware_update) | | 2891067 | FL SWITCH 3012E-2SFX | [Firmware Update](http://www.phoenixcontact.net/qr/2891067/firmware_update) | | 2891066 | FL SWITCH 3016E | [Firmware Update](http://www.phoenixcontact.net/qr/2891066/firmware_update) | | 2891058 | FL SWITCH 3016 | [Firmware Update](http://www.phoenixcontact.net/qr/2891058/firmware_update) | | 2891059 | FL SWITCH 3016T | [Firmware Update](http://www.phoenixcontact.net/qr/2891059/firmware_update) | | 2891060 | FL SWITCH 3006T-2FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891060/firmware_update) | | 2891062 | FL SWITCH 4008T-2SFP | [Firmware Update](http://www.phoenixcontact.net/qr/2891062/firmware_update) | | 2891061 | FL SWITCH 4008T-2GT-4FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891061/firmware_update) | | 2891160 | FL SWITCH 4008T-2GT-3FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891160/firmware_update) | | 2891073 | FL SWITCH 4808E-16FX LC-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891073/firmware_update) | | 2891080 | FL SWITCH 4808E-16FX SM-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891080/firmware_update) | | 2891086 | FL SWITCH 4808E-16FX SM ST-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891086/firmware_update) | | 2891085 | FL SWITCH 4808E-16FX ST-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891085/firmware_update) | | 2891079 | FL SWITCH 4808E-16FX-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891079/firmware_update) | | 2891074 | FL SWITCH 4808E-16FX SM LC-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891074/firmware_update) | | 2891063 | FL SWITCH 4012T 2GT 2FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891063/firmware_update) | | 2891161 | FL SWITCH 4012T-2GT-2FX ST | [Firmware Update](http://www.phoenixcontact.net/qr/2891161/firmware_update) | | 2891072 | FL SWITCH 4824E-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891072/firmware_update) | | 2891102 | FL SWITCH 4800E-24FX-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891102/firmware_update) | | 2891104 | FL SWITCH 4800E-24FX SM-4GC | [Firmware Update](http://www.phoenixcontact.net/qr/2891104/firmware_update) | | 2891120 | FL SWITCH 3012E-2FX | [Firmware Update](http://www.phoenixcontact.net/qr/2891120/firmware_update) | | 2891119 | FL SWITCH 3012E-2FX SM | [Firmware Update](http://www.phoenixcontact.net/qr/2891119/firmware_update) | | 2891162 | FL SWITCH 4000T-8POE-2SFP-R | Please contact your local customer service |
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan