Paper/Archive/CVE-2020-12519

CVE-2020-12519

Phoenix Contact AXC F 1152 (1151412) — Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use this vulnerability i.e. to open a reverse shell with root privileges.

EPSS 0.9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 58.6.586 × 2011.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges.

Affected

ProductAffectedFixed inSource

AXC F 1152 (1151412)unspecified – < 2021.0 LTS2021.0 LTSCNA

AXC F 2152 (2404267)unspecified – < 2021.0 LTS2021.0 LTSCNA

AXC F 3152 (1069208)unspecified – < 2021.0 LTS2021.0 LTSCNA

RFC 4072S (1051328unspecified – < 2021.0 LTS2021.0 LTSCNA

AXC F 2152 Starterkit (1046568)unspecified – < 2021.0 LTS2021.0 LTSCNA

PLCnext Technology Starterkit (1188165)unspecified – < 2021.0 LTS2021.0 LTSCNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CERTVDE (CNA)8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

refcert.vde.com/en-us/advisories/vde-2020-049