CVE-2023-1109
High
Description
In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service.
SeverityHigh
CVSS8.8
Exploit probability—
ProductPhoenixcontact Energy Axc Pu
PublishedApr 17, 2023
First seenApr 17, 2023
Weakness typeCWE-22Path traversal
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phoenixcontact energy_axc_pu | 01.00.00.00 ≤ v ≤ 04.15.00.00 | — |
| phoenixcontact infobox_firmware | 01.00.00.00 ≤ v ≤ 02.02.00.00 | — |
| phoenixcontact smartrtu_axc_sg_firmware | 01.00.00.00 ≤ v ≤ 01.08.00.02 | — |
| phoenixcontact smartrtu_axc_ig_firmware | 01.00.00.00 ≤ v ≤ 01.02.00.01 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.