CVE-2017-16743
published 2018-01-12CVE-2017-16743: An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A…
PriorityP264critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
3.11%
86.3th percentile
An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing the attacker to obtain administrative privileges on the device.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| phoenixcontact | fl_switch_3004t-fx_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3004t-fx_st_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3005_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3005t_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3006t-2fx_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3006t-2fx_sm_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3006t-2fx_st_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3008_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3008t_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3012e-2fx_sm_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3012e-2sfx_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3016_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3016e_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_3016t_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_4000t-8poe-2sfp-r_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_4008t-2gt-3fx_sm_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_4008t-2gt-4fx_sm_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_4008t-2sfp_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_4012t-2gt-2fx_st_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_4012t_2gt_2fx_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_4800e-24fx-4gc_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_4800e-24fx_sm-4gc_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_4808e-16fx-4gc_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_4808e-16fx_lc-4gc_firmware | 1.0 – 1.32 | — |
| phoenixcontact | fl_switch_4808e-16fx_sm-4gc_firmware | 1.0 – 1.32 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit vector is crafted special HTTP requests to bypass web-service authentication on the device's web interface, resulting in administrative privilege escalation without credentials ↗
- →The vulnerability is remotely exploitable with no authentication, no user interaction, and low attack complexity — monitor for unauthenticated HTTP requests to administrative web-service endpoints on FL SWITCH devices ↗
- →A companion information-exposure vulnerability (CVE-2017-16741) allows unauthenticated reading of diagnostic data via Monitor Mode — monitor for unauthenticated access to Monitor Mode endpoints on the same devices ↗
- ·All FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32 are vulnerable; firmware Version 1.33 or higher remediates the issue ↗
- ·No known public exploits specifically targeting these vulnerabilities existed at time of advisory publication ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
PHOENIX CONTACT FL SWITCH
cisa_ics·2018-01-11
PHOENIX CONTACT FL SWITCH
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
PHOENIX CONTACT FL SWITCH
Last RevisedJanuary 11, 2018
Alert CodeICSA-18-011-03
## CVSS v3 9.8
ATTENTION: Remotely exploitable/low skill level to exploit.
Vendor: PHOENIX CONTACT
Equipment: FL SWITCH
Vulnerabilities: Improper Authorization, Information Exposure
## AFFECTED PRODUCTS
All FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32 are affected.
## IMPACT
Successful exploitation of these vulnerabilities may allow an unauthenticated remote attacker to gain administrative privileges and expose information to unauthenticated users.
## M
GHSA
GHSA-xp4q-qhv3-758q: An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1
ghsa_unreviewed·2022-05-13
CVE-2017-16743 [CRITICAL] CWE-863 GHSA-xp4q-qhv3-758q: An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1
An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing the attacker to obtain administrative privileges on the device.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-01-12
Published