PHOENIX CONTACT: PC Worx/-Express prone to improper input validation vulnerability
PC Worx / -Express is vulnerable to a 'zip slip' style vulnerability when loading a project file.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-34597US | medium6.8 | — | ||
Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrar… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Mitigation
We strongly recommend customers to exchange project files only using secure file exchange services. Project files should not be exchanged via unencrypted email. In addition, we recommend exchanging or storing project files together with a checksum to ensure their integrity.
- Fixed
With the next version of Automation Worx Software Suite additional plausibility checks for archive content will be implemented.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan