Description
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Phoenix Contact CHARX SEC-3150
Default version status: unaffected
1.0.0 to < 1.9.1affected
Phoenix Contact CHARX SEC-3100
Default version status: unaffected
1.0.0 to < 1.9.1affected
Phoenix Contact CHARX SEC-3050
Default version status: unaffected
1.0.0 to < 1.9.1affected
Phoenix Contact CHARX SEC-3000
Default version status: unaffected
1.0.0 to < 1.9.1affected