CVE-2018-13990

CWE-287 — Improper Authentication3 documents3 sources

Severity

9.8CRITICAL

EPSS

1.3%

top 20.42%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

29

Phoenixcontact FL Switch 3004t-fx Firmware Phoenixcontact FL Switch 3004t-fx ST Firmware Phoenixcontact FL Switch 3005 Firmware +26 more

Timeline

PublishedMay 6

Latest updateMay 24

Description

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 is vulnerable to brute-force attacks, because of Improper Restriction of Excessive Authentication Attempts.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LExploitability: 3.9 | Impact: 4.7

Affected Packages29 packages

▶NVDphoenixcontact/fl_switch_3005_firmware< 1.35

▶NVDphoenixcontact/fl_switch_3008_firmware< 1.35

▶NVDphoenixcontact/fl_switch_3016_firmware< 1.35

▶NVDphoenixcontact/fl_switch_3005t_firmware< 1.35

▶NVDphoenixcontact/fl_switch_3008t_firmware< 1.35

🔴Vulnerability Details

2

GHSA

GHSA-8769-f7h2-qvf4: The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1↗2022-05-24

▶

CVEList

CVE-2018-13990: The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1↗2019-05-06

▶

CVE-2018-13990 (CRITICAL CVSS 9.8) | The WebUI of PHOENIX CONTACT FL SWI | cvebase.io