CVE-2018-13991

CWE-200 — Information Exposure3 documents3 sources

Severity

5.3MEDIUM

EPSS

0.1%

top 65.23%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

29

Phoenixcontact FL Switch 3004t-fx Firmware Phoenixcontact FL Switch 3004t-fx ST Firmware Phoenixcontact FL Switch 3005 Firmware +26 more

Timeline

PublishedMay 7

Latest updateMay 24

Description

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 leaks private information in firmware images.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages29 packages

▶NVDphoenixcontact/fl_switch_3005_firmware1.0 — 1.34

▶NVDphoenixcontact/fl_switch_3008_firmware1.0 — 1.34

▶NVDphoenixcontact/fl_switch_3016_firmware1.0 — 1.34

▶NVDphoenixcontact/fl_switch_3005t_firmware1.0 — 1.34

▶NVDphoenixcontact/fl_switch_3008t_firmware1.0 — 1.34

🔴Vulnerability Details

2

GHSA

GHSA-62xj-w7jf-v2q8: The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1↗2022-05-24

▶

CVEList

CVE-2018-13991: The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1↗2019-05-07

▶

CVE-2018-13991 (MEDIUM CVSS 5.3) | The WebUI of PHOENIX CONTACT FL SWI | cvebase.io