CVE-2016-8371
published 2018-04-05CVE-2016-8371: The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled.
PriorityP261high7.3CVSS 3.0
AVNACLPRNUINSUCLILAL
EXPLOIT
EPSS
10.85%
95.8th percentile
The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| composer | composer | >= 0 < 1.0.0 | 1.0.0 |
| phoenix_contact | phoenix_contact_ilc_plcs | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect unauthenticated HTTP GET requests to /<ProjectName>.tcr on Phoenix Contact ILC PLC web servers — this path leaks the full list of PLC tags without any authentication. ↗
- →Detect unauthenticated HTTP POST requests to /cgi-bin/ILRReadValues.exe — this endpoint returns current PLC variable values without requiring authentication. ↗
- →Detect unauthenticated HTTP GET requests to /cgi-bin/writeVal.exe with query parameters — this endpoint allows writing arbitrary values to PLC tags without authentication. ↗
- →Inspect HTTP responses from ILC PLC web root (/) for the string 'ProjectName' in HTML — attackers use this to enumerate the project name before further exploitation. ↗
- →The web server allows access to read and write PLC variables without authentication — alert on any access to ILRReadValues.exe or writeVal.exe from untrusted source IPs. ↗
- ·The authentication bypass (CVE-2016-8371) affects ALL ILC 1xx PLC versions — there is no version-specific scope; any ILC 1xx device with its web server exposed is vulnerable regardless of whether authentication is configured. ↗
- ·The exploit also covers CVE-2016-8380 (unauthenticated read/write of PLC variables) and CVE-2016-8366 (cleartext password storage/transfer) — detections targeting these CGI endpoints may surface all three CVEs simultaneously. ↗
- ·The WebVisit password macro can be configured to store and transfer passwords in cleartext, meaning network captures may expose credentials even on 'protected' HMI pages. ↗
CVSS provenance
nvdv3.07.3HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Phoenix Contact ILC PLC Authentication Vulnerabilities
cisa_ics·2019-01-24
Phoenix Contact ILC PLC Authentication Vulnerabilities
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Phoenix Contact ILC PLC Authentication Vulnerabilities
Last RevisedJanuary 24, 2019
Alert CodeICSA-16-313-01
## OVERVIEW
Matthias Niedermaier and Michael Kapfer of HSASec Hochschule Augsburg have identified authentication vulnerabilities in Phoenix Contact’s ILC (inline controller) PLCs. Phoenix Contact GmbH & Co. KG has produced a mitigation plan that includes an update and recommended security practices to mitigate these vulnerabilities.
These vulnerabilities could be exploited remotely.
## AFFECTED PRODUCTS
Phoenix Contact reports that these vulnerabilities affect the foll
GHSA
Composer allows cache poisoning from other projects built on the same host
ghsa·2023-09-21
CVE-2015-8371 [HIGH] CWE-345 Composer allows cache poisoning from other projects built on the same host
Composer allows cache poisoning from other projects built on the same host
Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus can be found by an attacker). Versions through 1.0.0-alpha11 are affected, and 1.0.0 is unaffected.
GHSA
GHSA-vprp-wv7r-hv9r: The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled
ghsa_unreviewed·2022-05-14
CVE-2016-8371 [HIGH] CWE-287 GHSA-vprp-wv7r-hv9r: The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled
The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled.
No detection rules found.
No writeups or analysis indexed.
2018-04-05
Published