CVE-2018-16994
High
Description
An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices and Bosch Rexroth S20-ETH-BK and Rexroth S20-PN-BK+ (the S20-PN-BK+/S20-ETH-BK fieldbus couplers sold by Bosch Rexroth contain technology from Phoenix Contact). Incorrect handling of a request with non-standard symbols allows remote attackers to initiate a complete lock up of the bus coupler. Authentication of the request is not required.
SeverityHigh
CVSS7.5
Exploit probability—
ProductPhoenixcontact Axl F Bk Pn Firmware
PublishedFeb 18, 2020
First seenFeb 18, 2020
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phoenixcontact axl_f_bk_pn_firmware | v ≤ 1.0.4 | — |
| phoenixcontact axl_f_bk_eth_firmware | v ≤ 1.12 | — |
| phoenixcontact axl_f_bk_eth_xc_firmware | v ≤ 1.11 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.