CVE-2024-28135

CWE-77 — Command InjectionCWE-20 — Improper Input Validation3 documents3 sources
Severity
5.0MEDIUM
EPSS
1.0%
top 23.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Phoenix Contact Charx Sec-3000Phoenix Contact Charx Sec-3050Phoenix Contact Charx Sec-3100+5 more
Timeline
PublishedMay 14

Description

A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NExploitability: 3.1 | Impact: 1.4

Affected Packages8 packages

🔴Vulnerability Details

2
CVEList
PHOENIX CONTACT: command injection vulnerability in the API of the CHARX Series↗2024-05-14
▶
GHSA
GHSA-wpvh-7c2r-23rh: A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to↗2024-05-14
▶
CVE-2024-28135 (MEDIUM CVSS 5) | A low privileged remote attacker ca | cvebase.io