Share: Email | Twitter

ID

VDE-2023-004

Published

2023-04-11 10:00 (CEST)

Last update

2023-03-24 11:56 (CET)

Vendor(s)

PHOENIX CONTACT GmbH & Co. KG

Product(s)

Article No┬░ Product Name Affected Version(s)
1264327 ENERGY AXC PU < V04.15.00.00
1169323 Infobox* <= V02.02.00.00
1264328 SMARTRTU AXC IG <= V01.02.00.01
1110435 SMARTRTU AXC SG <= V01.08.00.02

Summary

A Directory Traversal Vulnerability enables arbitrary file access in ENERGY AXC PU Web service.
An authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service.


Last Update:

April 11, 2023, 10:22 a.m.

Weakness

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')  (CWE-22) 

Summary

In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service.


Impact

The vulnerability enables an attacker to gain access to the file system of the devices. This can enable the attacker to compromise the device in terms of availability, integrity and confidentiality.

Solution

Mitigation

Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to Phoenix Contacts application note.
Measures to protect network-capable devices with Ethernet connection

Remediation

Phoenix Contact strongly recommends updating to the latest firmware mentioned in the list of affected products, which fixes this vulnerability.

Article no Article Fixed version
1264327 ENERGY AXC PU V04.15.00.01
1110435 SMARTRTU AXC SG V01.09.00.00
1264328 SMARTRTU AXC IG End of Q3 2023

* As Infobox (1169323) is discontinued no update will be available.

Reported by

This vulnerability was discovered and reported by Laokoon SecurITy GmbH on behalf of E.ON Digital Technology GmbH.
PHOENIX CONTACT kindly appreciates the coordinated disclosure of this vulnerability by the finder and thanks CERT@VDE for the coordination and support with this publication.