Description
An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing the attacker to obtain administrative privileges on the device.
References (2)
Core 2
Core References
Various Sources x_refsource_confirm
https://cert.vde.com/en-us/advisories/vde-2017-006
Patch, Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSA-18-011-03
Scores
CVSS v3
9.8
EPSS
0.0311
EPSS Percentile
86.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-285
CWE-863
Status
published
Products (29)
phoenixcontact/fl_switch_3004t-fx_firmware
1.0 - 1.32
phoenixcontact/fl_switch_3004t-fx_st_firmware
1.0 - 1.32
phoenixcontact/fl_switch_3005_firmware
1.0 - 1.32
phoenixcontact/fl_switch_3005t_firmware
1.0 - 1.32
phoenixcontact/fl_switch_3006t-2fx_firmware
1.0 - 1.32
phoenixcontact/fl_switch_3006t-2fx_sm_firmware
1.0 - 1.32
phoenixcontact/fl_switch_3006t-2fx_st_firmware
1.0 - 1.32
phoenixcontact/fl_switch_3008_firmware
1.0 - 1.32
phoenixcontact/fl_switch_3008t_firmware
1.0 - 1.32
phoenixcontact/fl_switch_3012e-2fx_sm_firmware
1.0 - 1.32
... and 19 more
Published
Jan 12, 2018
Tracked Since
Feb 18, 2026