CVEvulnerability

CVE-2019-9201

9.8 CRITICAL Published 2019-02-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-02-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.0 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:C
Weaknesses
CWE-306

Description

Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories.

Affected configurations

• phoenixcontact ilc 131 eth firmware • phoenixcontact ilc 131 eth\/xc firmware • phoenixcontact ilc 151 eth firmware • phoenixcontact ilc 151 eth\/xc firmware • phoenixcontact ilc 171 eth 2tx firmware • phoenixcontact ilc 191 eth 2tx firmware • phoenixcontact ilc 191 me\/an firmware • phoenixcontact axc 1050 firmware

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

Referenced by CWE · observed example (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References