CVE-2018-13993

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources

Severity

8.8HIGH

EPSS

0.1%

top 68.36%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

29

Phoenixcontact FL Switch 3004t-fx Firmware Phoenixcontact FL Switch 3004t-fx ST Firmware Phoenixcontact FL Switch 3005 Firmware +26 more

Timeline

PublishedMay 7

Latest updateMay 24

Description

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is prone to CSRF.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages29 packages

▶NVDphoenixcontact/fl_switch_3005_firmware1.0 — 1.34

▶NVDphoenixcontact/fl_switch_3008_firmware1.0 — 1.34

▶NVDphoenixcontact/fl_switch_3016_firmware1.0 — 1.34

▶NVDphoenixcontact/fl_switch_3005t_firmware1.0 — 1.34

▶NVDphoenixcontact/fl_switch_3008t_firmware1.0 — 1.34

🔴Vulnerability Details

2

GHSA

GHSA-x8c5-5338-rgc5: The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1↗2022-05-24

▶

CVEList

CVE-2018-13993: The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1↗2019-05-07

▶

CVE-2018-13993 (HIGH CVSS 8.8) | The WebUI of PHOENIX CONTACT FL SWI | cvebase.io