VDE-2021-052

PHOENIX CONTACT: PC Worx/-Express prone to improper input validation vulnerability

Advisory ansehen veröffentlicht 2021-11-03

PC Worx / -Express is vulnerable to a 'zip slip' style vulnerability when loading a project file.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2021-34597US	medium6.8	0.65% (51st)	—	2021-11-04
Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrar…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

VDE-2021-052: PHOENIX CONTACT: PC Worx/-Express prone to improper input validation vulnerability - HTMLself
PHOENIX CONTACT advisory overview at CERT@VDEexternal
VDE-2021-052: PHOENIX CONTACT: PC Worx/-Express prone to improper input validation vulnerability - CSAFself

Behebungen (2)

Mitigation
We strongly recommend customers to exchange project files only using secure file exchange services. Project files should not be exchanged via unencrypted email. In addition, we recommend exchanging or storing project files together with a checksum to ensure their integrity.
Behoben
With the next version of Automation Worx Software Suite additional plausibility checks for archive content will be implemented.

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan