by Kastro
Paper/Archive/CVE-2024-25996

CVE-2024-25996

PHOENIX CONTACT CHARX SEC-3000 — PHOENIX CONTACT: Remote code execution due to an origin validation error in CHARX Series

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 33.2.332 × 206.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user.

Affected

ProductAffectedFixed inSource
CHARX SEC-3000≤ 1.5.0–CNA
CHARX SEC-3050≤ 1.5.0–CNA
CHARX SEC-3100≤ 1.5.0–CNA
CHARX SEC-3150≤ 1.5.0–CNA
charx_sec_3000≤ 1.5.0–CISA-ADP
charx_sec_3050≤ 1.5.0–CISA-ADP
charx_sec_3100≤ 1.5.0–CISA-ADP
charx_sec_3150≤ 1.5.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CERTVDE (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcert.vde.com/en/advisories/VDE-2024-011