Unauthenticated Attacker Can Modify Device Configuration via File Write
CVE-2024-3913

5.9MEDIUM

Key Information:

Vendor
Phoenix Contact
Status
Charx Sec-3000 (1139022)
Charx Sec-3050 (1139018)
Charx Sec-3100 (1139012)
Charx Sec-3150 (1139012)
Vendor
CVE Published:
13 August 2024

Summary

An unauthenticated remote attacker can exploit this vulnerability to modify device configuration settings, taking advantage of a writable file that is accessible for a brief period following system startup. This weakness may allow unauthorized changes to critical configurations, potentially leading to further security risks and unauthorized access.

Affected Version(s)

CHARX SEC-3000 (1139022) 0.0.0 < 1.7.0

CHARX SEC-3050 (1139018) 0.0.0 < 1.7.0

CHARX SEC-3100 (1139012) 0.0.0 < 1.7.0

References

https://cert.vde.com/en/advisories/VDE-2024-022

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Olson, "gadha"
Trend Micro's Zero Day Initiative
.