CVE-2020-12517

published 2020-12-17

CVE-2020-12517: On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin…

critical 9 CVSS 3.1

AV N AC L PR L UI R S C C H I H A H

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).

Affected

7 ranges

Vendor	Product	Version range	Fixed in
phoenix_contact	axc_f_1152	>= unspecified < 2021.0 LTS	2021.0 LTS
phoenix_contact	axc_f_2152	>= unspecified < 2021.0 LTS	2021.0 LTS
phoenix_contact	axc_f_2152_starterkit	>= unspecified < 2021.0 LTS	2021.0 LTS
phoenix_contact	axc_f_3152	>= unspecified < 2021.0 LTS	2021.0 LTS
phoenix_contact	plcnext_technology_starterkit	>= unspecified < 2021.0 LTS	2021.0 LTS
phoenix_contact	rfc_4072s_1051328	>= unspecified < 2021.0 LTS	2021.0 LTS
phoenixcontact	plcnext_firmware	< 2021.0	2021.0

CWE-79