CVE-2024-25994

CWE-434 — Unrestricted File Upload CWE-20 — Improper Input Validation3 documents3 sources

Severity

5.3MEDIUM

EPSS

0.2%

top 53.54%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Phoenixcontact Charx Sec-3000 Firmware Phoenixcontact Charx Sec-3050 Firmware Phoenixcontact Charx Sec-3100 Firmware +5 more

Timeline

PublishedMar 12

Description

An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages8 packages

▶NVDphoenixcontact/charx_sec-3000_firmware< 1.5.1

▶NVDphoenixcontact/charx_sec-3050_firmware< 1.5.1

▶NVDphoenixcontact/charx_sec-3100_firmware< 1.5.1

▶NVDphoenixcontact/charx_sec-3150_firmware< 1.5.1

▶CVEListV5phoenix_contact/charx_sec-30001.5.0

🔴Vulnerability Details

CVEList

PHOENIX CONTACT: Unintended script file upload in CHARX Series↗2024-03-12

▶

GHSA

GHSA-54j6-6hq9-52fg: An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation↗2024-03-12

▶