PHOENIX CONTACT FL SWITCH 3xxx/4xxx/48xx series through 1.33 allows Command Injection

CGI applications config_transfer.cgi and software_update.cgi are prone to OS command injection.

VDE-2018-004 (2018-05-16 08:30 UTC+0200)

CVE Identifier

CVE-2018-10730

Affected Vendors

PHOENIX CONTACT

Affected Products

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33.

Summary

An attacker with permission to transfer configuration files to/from the switch or permission to upgrade firmware, is able to execute arbitrary OS shell commands. CGI applications config_transfer.cgi and software_update.cgi are prone to OS command injection through targeted manipulation of their web-request headers.

Impact

If the vulnerability is exploited, the attacker may create their own executable files that could further exploit the integrity of the managed FL SWITCH. For example, the attacker may deny switch network access.

Solution

Temporary Fix / Mitigation

Customers using Phoenix Contact managed FL SWITCH devices with affected firmware versions are recommended to disable the switch Web Agent.

Remediation

Customers using Phoenix Contact managed FL SWITCH devices with affected firmware versions are recommended to update the firmware to version 1.34 or higher which fixes this vulnerability. The updated firmware may be downloaded from the managed switch product page on the Phoenix Contact website:

Article No. Model Updated Firmware
2891030 FL SWITCH 3005 www.phoenixcontact.net/qr/2891030/firmware_update
2891032 FL SWITCH 3005T www.phoenixcontact.net/qr/2891032/firmware_update
2891033 FL SWITCH 3004T-FX www.phoenixcontact.net/qr/2891033/firmware_update
2891034 FL SWITCH 3004T-FX ST www.phoenixcontact.net/qr/2891034/firmware_update
2891031 FL SWITCH 3008 www.phoenixcontact.net/qr/2891031/firmware_update
2891035 FL SWITCH 3008T www.phoenixcontact.net/qr/2891035/firmware_update
2891036 FL SWITCH 3006T-2FX www.phoenixcontact.net/qr/2891036/firmware_update
2891037 FL SWITCH 3006T-2FX ST www.phoenixcontact.net/qr/2891037/firmware_update
2891067 FL SWITCH 3012E-2SFX www.phoenixcontact.net/qr/2891067/firmware_update
2891066 FL SWITCH 3016E www.phoenixcontact.net/qr/2891066/firmware_update
2891058 FL SWITCH 3016 www.phoenixcontact.net/qr/2891058/firmware_update
2891059 FL SWITCH 3016T www.phoenixcontact.net/qr/2891059/firmware_update
2891060 FL SWITCH 3006T-2FX SM www.phoenixcontact.net/qr/2891060/firmware_update
2891062 FL SWITCH 4008T-2SFP www.phoenixcontact.net/qr/2891062/firmware_update
2891061 FL SWITCH 4008T-2GT-4FX SM www.phoenixcontact.net/qr/2891061/firmware_update
2891160 FL SWITCH 4008T-2GT-3FX SM www.phoenixcontact.net/qr/2891160/firmware_update
2891073 FL SWITCH 4808E-16FX LC-4GC www.phoenixcontact.net/qr/2891073/firmware_update
2891080 FL SWITCH 4808E-16FX SM-4GC www.phoenixcontact.net/qr/2891080/firmware_update
2891086 FL SWITCH 4808E-16FX SM ST-4GC www.phoenixcontact.net/qr/2891086/firmware_update
2891085 FL SWITCH 4808E-16FX ST-4GC www.phoenixcontact.net/qr/2891085/firmware_update
2891079 FL SWITCH 4808E-16FX-4GC www.phoenixcontact.net/qr/2891079/firmware_update
2891074 FL SWITCH 4808E-16FX SM LC-4GC www.phoenixcontact.net/qr/2891074/firmware_update
2891063 FL SWITCH 4012T 2GT 2FX www.phoenixcontact.net/qr/2891063/firmware_update
2891161 FL SWITCH 4012T-2GT-2FX ST www.phoenixcontact.net/qr/2891161/firmware_update
2891072 FL SWITCH 4824E-4GC www.phoenixcontact.net/qr/2891072/firmware_update
2891102 FL SWITCH 4800E-24FX-4GC www.phoenixcontact.net/qr/2891102/firmware_update
2891104 FL SWITCH 4800E-24FX SM-4GC www.phoenixcontact.net/qr/2891104/firmware_update
2891120 FL SWITCH 3012E-2FX www.phoenixcontact.net/qr/2891120/firmware_update
2891119 FL SWITCH 3012E-2FX SM www.phoenixcontact.net/qr/2891119/firmware_update
2891162 FL SWITCH 4000T-8POE-2SFP-R please contact your local customer service

Reported by

Vyacheslav Moskvin (Positive Technologies) reported these vulnerabilities to PHOENIX CONTACT