Phoenix Contact: Security Advisory for CHARX-SEC3xxx Charge controllers
Start sequence for firewall service allows attack during the boot process. Password is reset to default when the device undergoes a firmware upgrade.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-6788US | critical9.8OT erhöht | — | ||
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to… | ||||
| CVE-2024-3913US | — | — | ||
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Phoenix Contact advisory overview at CERT@VDEexternal
- VDE-2024-022: Phoenix Contact: Security Advisory for CHARX-SEC3xxx Charge controllers - HTMLself
- Phoenix Contact application noteexternal
- 2024/00003:external
- VDE-2024-022: Phoenix Contact: Security Advisory for CHARX-SEC3xxx Charge controllers - CSAFself
Behebungen (4)
- Behoben
Phoenix Contact strongly recommends upgrading affected charge controllers to firmware version 1.6.3 or higher which fixes these vulnerabilities.
- Behoben
Phoenix Contact strongly recommends upgrading affected charge controllers to firmware version 1.6.3 or higher which fixes these vulnerabilities.
- Workaround
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to General Recommendation.
- Workaround
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to General Recommendation.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan