PHOENIX CONTACT: Vulnerability in classic line industrial controllers
The affected devices insufficiently verify uploaded data.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-31800US | high10.0OT elevated | — | ||
An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. | ||||
references
External citations — patches, advisories, analysis.
remediations (1)
- Mitigation
Phoenix Contact classic line controllers are designed and developed for the use in closed industrial networks. The controller doesn't feature logic integrity and authenticity checks by design. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall. Customers using Phoenix Contact classic line controllers are recommended to operate the devices in closed networks or protected with a suitable firewall as intended. Generic information and recommendations for security measures to protect network-capable devices can be found in the application note.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan