CVEvulnerability

CVE-2023-1109

8.8 HIGH Published 2023-04-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-04-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22

Description

In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service.

Affected configurations

• phoenixcontact energy axc pu (>= 01.00.00.00 <= 04.15.00.00) • phoenixcontact infobox firmware (>= 01.00.00.00 <= 02.02.00.00) • phoenixcontact smartrtu axc sg firmware (>= 01.00.00.00 <= 01.08.00.02) • phoenixcontact smartrtu axc ig firmware (>= 01.00.00.00 <= 01.02.00.01)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References