{"id":"CVE-2019-9201","state":"PUBLISHED","title":"Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create","description":"Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories.","publishedAt":"2019-02-26T23:00:00.000Z","updatedAt":"2026-06-02T20:15:38.573Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"mitre"},"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://medium.com/%40SergiuSechel/misconfiguration-in-ilc-gsm-gprs-devices-leaves-over-1-200-ics-devices-vulnerable-to-attacks-over-82c2d4a91561","https://cert.vde.com/en/advisories/VDE-2019-015/"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T19:46:15.253Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/9xxx/CVE-2019-9201.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2019-9201","state":"PUBLISHED","datePublished":"2019-02-26T23:00:00.000Z","dateUpdated":"2026-06-02T20:15:38.573Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2019-02-26T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://medium.com/%40SergiuSechel/misconfiguration-in-ilc-gsm-gprs-devices-leaves-over-1-200-ics-devices-vulnerable-to-attacks-over-82c2d4a91561","tags":["x_refsource_MISC"]},{"url":"https://cert.vde.com/en/advisories/VDE-2019-015/","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"mitre","dateUpdated":"2022-06-21T08:05:10.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca"},"datePublic":"2022-06-21T00:00:00.000Z","source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","DATE_PUBLIC":"2022-06-21T07:00:00.000Z","ID":"CVE-2019-9201","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://medium.com/@SergiuSechel/misconfiguration-in-ilc-gsm-gprs-devices-leaves-over-1-200-ics-devices-vulnerable-to-attacks-over-82c2d4a91561","refsource":"MISC","url":"https://medium.com/@SergiuSechel/misconfiguration-in-ilc-gsm-gprs-devices-leaves-over-1-200-ics-devices-vulnerable-to-attacks-over-82c2d4a91561"},{"name":"https://cert.vde.com/en/advisories/VDE-2019-015/","refsource":"CONFIRM","url":"https://cert.vde.com/en/advisories/VDE-2019-015/"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://medium.com/%40SergiuSechel/misconfiguration-in-ilc-gsm-gprs-devices-leaves-over-1-200-ics-devices-vulnerable-to-attacks-over-82c2d4a91561","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://cert.vde.com/en/advisories/VDE-2019-015/","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T21:38:46.548Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-02T20:00:27.607085Z","id":"CVE-2019-9201","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","type":"CWE","lang":"en","description":"CWE-306 Missing Authentication for Critical Function"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-02T20:15:38.573Z"}}]}}}