Insufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering tool
CVE-2022-31801

9.8CRITICAL

Key Information:

Vendor: Phoenix Contact
Status: Multiprog; Proconos; Proconos Eclr
Vendor: CVE Published:; 21 June 2022

🔔 Create Phoenix Contact Vulnerability Alert

What is CVE-2022-31801?

An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.

Affected Version(s)

MULTIPROG All Versions

ProConOS All Versions

ProConOS eCLR All Versions

References

https://cert.vde.com/en/advisories/VDE-2022-026/

x_refsource_CONFIRM

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 21, 2022
Vulnerability Reserved
May 30, 2022

Credit

This vulnerability was reported by Forescout.