CVE-2017-16743 An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to...
CriticalCVSS 9.8
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing the attacker to obtain administrative privileges on the device.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phoenixcontact fl switch 3005 firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3005t firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3004t-fx firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3004t-fx st firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3008 firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3008t firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3006t-2fx firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3006t-2fx st firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3012e-2sfx firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3016e firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3016 firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3016t firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3006t-2fx sm firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4008t-2sfp firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4008t-2gt-4fx sm firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4008t-2gt-3fx sm firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4808e-16fx lc-4gc firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4808e-16fx sm-4gc firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4808e-16fx sm st-4gc firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4808e-16fx st-4gc firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4808e-16fx-4gc firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4808e-16fx sm lc-4gc firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4012t 2gt 2fx firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4012t-2gt-2fx st firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4824e-4gc firmware | >= 1.0, <= 1.32 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| phoenixcontact fl switch 4800e-24fx-4gc firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4800e-24fx sm-4gc firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 3012e-2fx sm firmware | >= 1.0, <= 1.32 | No fix listed |
| phoenixcontact fl switch 4000t-8poe-2sfp-r firmware | >= 1.0, <= 1.32 | No fix listed |
References
- cert.vde.com
- ics-cert.us-cert.gov patch third-party-advisory us-government-resource