An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 17
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Phoenix_Contact Axc_F_1152_Firmware
cpe:2.3:o:phoenix_contact:axc_f_1152_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Axc_F_1252_Firmware
cpe:2.3:o:phoenix_contact:axc_f_1252_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Axc_F_2000_Ea_Firmware
cpe:2.3:o:phoenix_contact:axc_f_2000_ea_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Axc_F_2152_Firmware
cpe:2.3:o:phoenix_contact:axc_f_2152_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Axc_F_3152_Firmware
cpe:2.3:o:phoenix_contact:axc_f_3152_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Bpc_9102s_Firmware
cpe:2.3:o:phoenix_contact:bpc_9102s_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Bpc_9202s_Firmware
cpe:2.3:o:phoenix_contact:bpc_9202s_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Rfc_4072r_Firmware
cpe:2.3:o:phoenix_contact:rfc_4072r_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Rfc_4072s_Firmware
cpe:2.3:o:phoenix_contact:rfc_4072s_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Vl3_Upc_2440_Edge_Firmware
cpe:2.3:o:phoenix_contact:vl3_upc_2440_edge_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Vplcnext_Control_1000_Firmware
cpe:2.3:o:phoenix_contact:vplcnext_control_1000_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Vplcnext_Control_2000_Firmware
cpe:2.3:o:phoenix_contact:vplcnext_control_2000_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Vplcnext_Control_3000_Firmware
cpe:2.3:o:phoenix_contact:vplcnext_control_3000_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Vplcnext_Control_500_Firmware
cpe:2.3:o:phoenix_contact:vplcnext_control_500_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Catan_C1_Firmware
cpe:2.3:o:phoenix_contact:catan_c1_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Epc_1502_Firmware
cpe:2.3:o:phoenix_contact:epc_1502_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|
|
Phoenix_Contact Epc_1522_Firmware
cpe:2.3:o:phoenix_contact:epc_1522_firmware:*:*:*:*:*:*:*:*
|
2019.0.4
|
2026.0.3
|