CVE-2018-13990

mediumPriorität · verfolgen · 40EPSS 0.023 · 83. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

2.31% (83rd) EPSS

CVSS 5 · medium

Is it mine?

128 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-22

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 is vulnerable to brute-force attacks, because of Improper Restriction of Excessive Authentication Attempts.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenphoenix_contact_psirt
## Remediation for CWE-319 (CVE-2018-13992) Customers using Phoenix Contact managed FL SWITCH devices are recommended to enable HTTP security. ## Remediation for Multiple CWEs: (CWE-352 (CVE-2018-13993), CWE-307 (CVE-2018-13990), CWE-400 (CVE-2018-13994), CWE-922 (CVE-2018-13991), CWE-119 (CVE-2017-3735)) Customers using Phoenix Contact managed FL SWITCH devices with affected firmware versions are recommended to update the firmware to version **1.35 or higher**, which fixes these vulnerabilities. The updated firmware may be downloaded from the managed switch product page on the Phoenix Contact website: | Article No. | Model | Updated Firmware | |-------------|--------------------------------|------------------| | 2891033 | FL SWITCH 3004T-FX | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3004t-fx-2891033?type=firmware_update) | | 2891034 | FL SWITCH 3004T-FX ST | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3004t-fx-st-2891034?type=firmware_update) | | 2891030 | FL SWITCH 3005 | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3005-2891030?type=firmware_update) | | 2891032 | FL SWITCH 3005T | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3005t-2891032?type=firmware_update) | | 2891036 | FL SWITCH 3006T-2FX | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3006t-2fx-2891036?type=firmware_update) | | 2891060 | FL SWITCH 3006T-2FX SM | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3006t-2fx-sm-2891060?type=firmware_update) | | 2891037 | FL SWITCH 3006T-2FX ST | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3006t-2fx-st-2891037?type=firmware_update) | | 2891031 | FL SWITCH 3008 | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3008-2891031?type=firmware_update) | | 2891035 | FL SWITCH 3008T | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3008t-2891035?type=firmware_update) | | 2891120 | FL SWITCH 3012E-2FX | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3012e-2fx-2891120?type=firmware_update) | | 2891119 | FL SWITCH 3012E-2FX SM | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3012e-2fx-sm-2891119?type=firmware_update) | | 2891067 | FL SWITCH 3012E-2SFX | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3012e-2sfx-2891067?type=firmware_update) | | 2891058 | FL SWITCH 3016 | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3016-2891058?type=firmware_update) | | 2891066 | FL SWITCH 3016E | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3016e-2891066?type=firmware_update) | | 2891059 | FL SWITCH 3016T | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-3016t-2891059?type=firmware_update) | | 1026924 | FL SWITCH 4000T-4POE-1SFP | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4000t-4poe-1sfp-1026924?type=firmware_update) | | 1026923 | FL SWITCH 4000T-8POE-2SFP | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4000t-8poe-2sfp-1026923?type=firmware_update) | | 1026922 | FL SWITCH 4004T-8POE-4SFP | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4004t-8poe-4sfp-1026922?type=firmware_update) | | 2891160 | FL SWITCH 4008T-2GT-3FX SM | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4008t-2gt-3fx-sm-2891160?type=firmware_update) | | 2891061 | FL SWITCH 4008T-2GT-4FX SM | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4008t-2gt-4fx-sm-2891061?type=firmware_update) | | 2891062 | FL SWITCH 4008T-2SFP | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4008t-2sfp-2891062?type=firmware_update) | | 2891063 | FL SWITCH 4012T-2GT-2FX | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4012t-2gt-2fx-2891063?type=firmware_update) | | 2891161 | FL SWITCH 4012T-2GT-2FX ST | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4012t-2gt-2fx-st-2891161?type=firmware_update) | | 2891104 | FL SWITCH 4800E-24FX SM-4GC | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4800e-24fx-sm-4gc-2891104?type=firmware_update) | | 2891102 | FL SWITCH 4800E-24FX-4GC | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4800e-24fx-4gc-2891102?type=firmware_update) | | 2891073 | FL SWITCH 4808E-16FX LC-4GC | [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4808e-16fx-lc-4gc-2891073?type=firmware_update) | | 2891074 | FL SWITCH 4808E-16FX SM LC-4GC| [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4808e-16fx-sm-lc-4gc-2891074?type=firmware_update) | | 2891086 | FL SWITCH 4808E-16FX SM ST-4GC| [Download](https://www.phoenixcontact.com/de-de/produkte/switch-fl-switch-4808e-16fx-sm-st-4gc-2891086?type=firmware_update) |
MitigationFL SWITCH 3xxx 4xxx and 48xxcisa_csaf_ot
Phoenix Contact also recommends that users using the Phoenix Contact managed FL SWITCH devices enable HTTP security.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 5–9.8

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.08.6highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Lsecondary · CISA US

v3.08.6highCVSS:3.0/AC:L/AV:N/A:L/C:H/I:L/PR:N/S:U/UI:Nsecondary · ENISA EU

v3.08.6highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Lsecondary · cve@mitre.org USAusnutzbarkeit 3.9 · Auswirkung 4.7

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Phoenix Contact PSIRT DE

v3.09criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-287USprimärCWE-287USCWE-307US

04

betroffene Produkte (128)

Betroffene Produkte und Versionsbereiche.

FL SWITCH 3xxx 4xxx and 48xx: versions prior to Version 1.35alle Versionencisa_csaf_otUS
PHOENIX CONTACT, Innominate Security Technologies FL SWITCH 3xxx 4xxx and 48xx< 1.35cisa_csaf_otUS
n/a n/a≤ n/aenisa_euvdEU
phoenixcontact fl switch 3004t-fx firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3004t-fx_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3004t-fx st firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3004t-fx_st_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3005 firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3005_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3005t firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3005t_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3006t-2fx firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3006t-2fx_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3006t-2fx sm firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3006t-2fx_sm_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3006t-2fx st firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3006t-2fx_st_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3008 firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3008_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3008t firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3008t_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3012e-2fx sm firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3012e-2fx_sm_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3012e-2sfx firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3012e-2sfx_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3016 firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3016_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3016e firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3016e_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 3016t firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_3016t_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 4000t-8poe-2sfp-r firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_4000t-8poe-2sfp-r_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 4008t-2gt-3fx sm firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_4008t-2gt-3fx_sm_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch 4008t-2gt-4fx sm firmware< 1.35nvdUScpe:2.3:o:phoenixcontact:fl_switch_4008t-2gt-4fx_sm_firmware:*:*:*:*:*:*:*:*

20 von 128 angezeigt

05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

VDE-2019-001PHOENIX CONTACT: Multiple Vulnerabilities in FL SWITCH 3xxx, 4xxx and 48xx2019-01-23csaf · phoenix_contact_psirtDE
Multiple vulnerabilities for FL SWITCH have been identified in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx version 1.0 to 1.34.
ICSA-19-024-02PHOENIX CONTACT FL SWITCH2019-01-24icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may allow attackers to have user privileges, gain access to the switch, read user credentials, deny access to the switch, or perform man-in-the-middle attacks.

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot nvd phoenix_contact_psirt NVD CVE.org MITRE

veröffentlicht 2019-05-06geändert 2026-06-17

08

verwandt (7,667)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-105133US	high7.3OT kritisch	5.79% (93rd)	KEV	2026-10-04
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Perform…
CVE-2026-82329US	—OT kritisch	14.4% (97th)	KEV	2026-08-28
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileg…
CVE-2026-42018US	—OT kritisch	9.80% (96th)	KEV	2026-08-12
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CVE-2026-65400US	—OT kritisch	1.72% (77th)	KEV	2026-08-06
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the netwo…
CVE-2026-16232US	critical9.8OT kritisch	78.0% (100th)	KEV	2026-07-22
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to au…

09

Referenzen (9)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan