Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2023-1109

PHOENIX CONTACT: Directory Traversal Vulnerability in ENERGY AXC PU Web service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHOENIX CONTACT ENERGY AXC PU (1264327)

Default version status: unaffected

  • V01.00.00.00 to ≤ V04.15.00.00affected

PHOENIX CONTACT SMARTRTU AXC SG (1110435)

Default version status: unaffected

  • V01.00.00.00 to ≤ V01.08.00.02affected

PHOENIX CONTACT SMARTRTU AXC IG (1264328)

Default version status: unaffected

  • V01.00.00.00 to ≤ V01.02.00.01affected

PHOENIX CONTACT Infobox (1169323 )

Default version status: affected

  • V01.00.00.00 to ≤ V02.02.00.00affected

References