by Kastro
Paper/Archive/CVE-2024-25995

CVE-2024-25995

PHOENIX CONTACT CHARX SEC-3000 — PHOENIX CONTACT: Remote code execution in CHARX Series

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.6.726 × 2014.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation.

Affected

ProductAffectedFixed inSource
CHARX SEC-3000≤ 1.5.0–CNA
CHARX SEC-3050≤ 1.5.0–CNA
CHARX SEC-3100≤ 1.5.0–CNA
CHARX SEC-3150≤ 1.5.0–CNA
charx_sec_3000≤ 1.5.0–CISA-ADP
charx_sec_3050≤ 1.5.0–CISA-ADP
charx_sec_3100≤ 1.5.0–CISA-ADP
charx_sec_3150≤ 1.5.0–CISA-ADP

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorycert.vde.com/en/advisories/VDE-2024-011writeupzerodayinitiative.com/advisories/ZDI-24-856