CVE-2023-3526
PHOENIX CONTACT: Cross-site Scripting vulnerability in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devices
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
PHOENIX CONTACT · CLOUD CLIENT 1101T-TX/TXPHOENIX CONTACT · TC CLOUD CLIENT 1002-4GPHOENIX CONTACT · TC CLOUD CLIENT 1002-4G ATTPHOENIX CONTACT · TC CLOUD CLIENT 1002-4G VZWPHOENIX CONTACT · TC ROUTER 3002T-4GPHOENIX CONTACT · TC ROUTER 3002T-4G ATTPHOENIX CONTACT · TC ROUTER 3002T-4G VZWPoCs públicas encontradas — 1
cve_referencepacketstormsecurity.com/files/174152/Phoenix-Contact-TC-Cloud-TC-Router-2.x-XSS-Memory-Consumption.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →