Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-10998

An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LTS devices. Unlimited physical access to the PLC may lead to a manipulation of SD cards data. SD card manipulation may lead to an authentication bypass opportunity.

Published

2019-06-18T13:15:10.707

Last Modified

2024-11-21T04:20:19.380

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 6.8 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

3.9

Impact Score

6.4

Weaknesses

Type: Primary
CWE-287

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	phoenixcontact	axc_f_2152_firmware	< 2019.0_lts	Yes
Hardware	phoenixcontact	axc_f_2152	-	No
Operating System	phoenixcontact	axc_f_2152_starterkit_firmware	< 2019.0_lts	Yes
Hardware	phoenixcontact	axc_f_2152_starterkit	-	No

References

https://dam-mdc.phoenixcontact.com/asset/156443151564/fa7be4d04c301f18c6cc0e0872193a42/Security_Advisory_AXC_F_2152_FW.pdf Mitigation, Vendor Advisory ([email protected])
https://dam-mdc.phoenixcontact.com/asset/156443151564/fa7be4d04c301f18c6cc0e0872193a42/Security_Advisory_AXC_F_2152_FW.pdf Mitigation, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)