CVE-2023-3526
criticalPriorität · verfolgen · 1EPSS 0.018 · 78. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobenphoenix_contact_psirt
Phoenix Contact strongly recommends updating to the latest available firmware version, which fixes these vulnerabilities.
- BehobenCLOUD CLIENT 1101T-TX/TXcisa_csaf_ot
CLOUD CLIENT 1101T-TX/TX
https://www.phoenixcontact.net/qr/1221706/firmware_update - BehobenTC CLOUD CLIENT 1002-4Gcisa_csaf_ot
TC CLOUD CLIENT 1002-4G
https://www.phoenixcontact.net/qr/2702886/firmware_update - BehobenTC CLOUD CLIENT 1002-4G ATTcisa_csaf_ot
TC CLOUD CLIENT 1002-4G ATT
https://www.phoenixcontact.net/qr/2702888/firmware_update - BehobenTC CLOUD CLIENT 1002-4G VZWcisa_csaf_ot
TC CLOUD CLIENT 1002-4G VZW
https://www.phoenixcontact.net/qr/2702887/firmware_update - BehobenTC ROUTER 3002T-4Gcisa_csaf_ot
TC ROUTER 3002T-4G
https://www.phoenixcontact.net/qr/2702528/firmware_update - BehobenTC ROUTER 3002T-4G ATTcisa_csaf_ot
TC ROUTER 3002T-4G ATT
https://www.phoenixcontact.net/qr/2702533/firmware_update - BehobenTC ROUTER 3002T-4G VZWcisa_csaf_ot
TC ROUTER 3002T-4G VZW
https://www.phoenixcontact.net/qr/2702532/firmware_update - Mitigationphoenix_contact_psirt
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
- MitigationCLOUD CLIENT 1101T-TX/TXcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC CLOUD CLIENT 1002-4Gcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC CLOUD CLIENT 1002-4G ATTcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC CLOUD CLIENT 1002-4G VZWcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC ROUTER 3002T-4Gcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC ROUTER 3002T-4G ATTcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC ROUTER 3002T-4G VZWcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 8.8–9.6
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (50)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- VDE-2023-017Phoenix Contact: Multiple vulnerabilities in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devices2023-08-08csaf · phoenix_contact_psirtDE
Two vulnerabilities have been discovered in the firmware of TC ROUTER and TC CLOUD CLIENT devices. Update A, 2024-08-12 Added a summary text Added details to impact
- WID-SEC-W-2023-1975Phoenix Contact TC ROUTER und TC CLOUD CLIENT: Mehrere SchwachstellenDeutsch2023-08-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Phoenix Contact TC ROUTER und TC CLOUD CLIENT Geräten ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und um einen Denial of Service Zustad herbeizuführen.
- ICSA-23-250-02Phoenix Contact TC ROUTER and TC CLOUD CLIENT2023-09-07icsa · cisa_csaf_otUS
Successful exploitation of this these vulnerabilities could execute code in the context of the user's browser or cause a denial of service.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (13)
Externe Belege — Patches, Meldungen, Analysen.
- http://seclists.org/fulldisclosure/2023/Aug/12cnnvd
- https://cert.vde.com/en/advisories/VDE-2023-017cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-3526/cnnvd
- https://cxsecurity.com/issue/WLB-2023080063cnnvd
- https://packetstormsecurity.com/files/174152/Phoenix-Contact-TC-Cloud-TC-Router-2.x-XSS-Memory-Consumption.htmlcnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.5120cnnvd
- https://www.phoenixcontact.com/en-us/contactPatchcnnvd
- http://packetstormsecurity.com/files/174152/Phoenix-Contact-TC-Cloud-TC-Router-2.x-XSS-Memory-Consumption.htmlenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan