CVE-2017-16723
Medium
Description
A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422/485, FL COMSERVER BAS 232/422/485-T, FL COMSERVER UNI 232/422/485-T, FL COM SERVER RS232, FL COM SERVER RS485, and PSI-MODEM/ETH (running firmware versions prior to 1.99, 2.20, or 2.40). The cross-site scripting vulnerability has been identified, which may allow remote code execution.
SeverityMedium
CVSS6.1
Exploit probability—
ProductPhoenixcontact Fl Comserver Basic 232 Firmware
PublishedDec 11, 2017
First seenDec 11, 2017
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phoenixcontact fl_comserver_basic_232_firmware | 2.40 | — |
| phoenixcontact fl_comserver_uni_422_firmware | 2.40 | — |
| phoenixcontact fl_comserver_bas_485-t_firmware | 2.40 | — |
| phoenixcontact fl_com_server_rs232_firmware | 1.99 | — |
| phoenixcontact fl_com_server_rs485_firmware | 1.99 | — |
| phoenixcontact psi-modem\/eth_firmware | 2.20 | — |
| phoenixcontact fl_comserver_basic_422_firmware | 2.40 | — |
| phoenixcontact fl_comserver_basic_485_firmware | 2.40 | — |
| phoenixcontact fl_comserver_uni_485-t_firmware | 2.40 | — |
| phoenixcontact fl_comserver_uni_485_firmware | 2.40 | — |
| phoenixcontact fl_comserver_uni_232_firmware | 2.40 | — |
| phoenixcontact fl_comserver_bas_422_firmware | 2.40 | — |
| phoenixcontact fl_comserver_bas_232_firmware | 2.40 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.