CVE-2023-3526
criticalpriority · track · 1EPSS 0.018 · 78 %ileDEEURUUSEPSS · scored 2026-10-27
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedphoenix_contact_psirt
Phoenix Contact strongly recommends updating to the latest available firmware version, which fixes these vulnerabilities.
- FixedCLOUD CLIENT 1101T-TX/TXcisa_csaf_ot
CLOUD CLIENT 1101T-TX/TX
https://www.phoenixcontact.net/qr/1221706/firmware_update - FixedTC CLOUD CLIENT 1002-4Gcisa_csaf_ot
TC CLOUD CLIENT 1002-4G
https://www.phoenixcontact.net/qr/2702886/firmware_update - FixedTC CLOUD CLIENT 1002-4G ATTcisa_csaf_ot
TC CLOUD CLIENT 1002-4G ATT
https://www.phoenixcontact.net/qr/2702888/firmware_update - FixedTC CLOUD CLIENT 1002-4G VZWcisa_csaf_ot
TC CLOUD CLIENT 1002-4G VZW
https://www.phoenixcontact.net/qr/2702887/firmware_update - FixedTC ROUTER 3002T-4Gcisa_csaf_ot
TC ROUTER 3002T-4G
https://www.phoenixcontact.net/qr/2702528/firmware_update - FixedTC ROUTER 3002T-4G ATTcisa_csaf_ot
TC ROUTER 3002T-4G ATT
https://www.phoenixcontact.net/qr/2702533/firmware_update - FixedTC ROUTER 3002T-4G VZWcisa_csaf_ot
TC ROUTER 3002T-4G VZW
https://www.phoenixcontact.net/qr/2702532/firmware_update - Mitigationphoenix_contact_psirt
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note. Measures to protect network-capable devices with Ethernet connection
- MitigationCLOUD CLIENT 1101T-TX/TXcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC CLOUD CLIENT 1002-4Gcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC CLOUD CLIENT 1002-4G ATTcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC CLOUD CLIENT 1002-4G VZWcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC ROUTER 3002T-4Gcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC ROUTER 3002T-4G ATTcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
- MitigationTC ROUTER 3002T-4G VZWcisa_csaf_ot
Phoenix Contact has made the following fixed versions available and encourages users to download the latest version:
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.8–9.6
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (50)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- VDE-2023-017Phoenix Contact: Multiple vulnerabilities in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devices2023-08-08csaf · phoenix_contact_psirtDE
Two vulnerabilities have been discovered in the firmware of TC ROUTER and TC CLOUD CLIENT devices. Update A, 2024-08-12 Added a summary text Added details to impact
- WID-SEC-W-2023-1975Phoenix Contact TC ROUTER und TC CLOUD CLIENT: Mehrere SchwachstellenDeutsch2023-08-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Phoenix Contact TC ROUTER und TC CLOUD CLIENT Geräten ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und um einen Denial of Service Zustad herbeizuführen.
- ICSA-23-250-02Phoenix Contact TC ROUTER and TC CLOUD CLIENT2023-09-07icsa · cisa_csaf_otUS
Successful exploitation of this these vulnerabilities could execute code in the context of the user's browser or cause a denial of service.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- http://seclists.org/fulldisclosure/2023/Aug/12cnnvd
- https://cert.vde.com/en/advisories/VDE-2023-017cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-3526/cnnvd
- https://cxsecurity.com/issue/WLB-2023080063cnnvd
- https://packetstormsecurity.com/files/174152/Phoenix-Contact-TC-Cloud-TC-Router-2.x-XSS-Memory-Consumption.htmlcnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.5120cnnvd
- https://www.phoenixcontact.com/en-us/contactPatchcnnvd
- http://packetstormsecurity.com/files/174152/Phoenix-Contact-TC-Cloud-TC-Router-2.x-XSS-Memory-Consumption.htmlenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan