Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-12517

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).

Published

2020-12-17T23:15:12.873

Last Modified

2024-11-21T04:59:51.010

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

6.8

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-79
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System phoenixcontact plcnext_firmware < 2021.0 Yes
Hardware phoenixcontact axc_f_1152 - No
Operating System phoenixcontact plcnext_firmware < 2021.0 Yes
Hardware phoenixcontact axc_f_2152 - No
Operating System phoenixcontact plcnext_firmware < 2021.0 Yes
Hardware phoenixcontact axc_f_3152 - No
Operating System phoenixcontact plcnext_firmware < 2021.0 Yes
Hardware phoenixcontact rfc_4072s - No
Operating System phoenixcontact plcnext_firmware < 2021.0 Yes
Hardware phoenixcontact axc_f_2152_starterkit - No
Operating System phoenixcontact plcnext_firmware < 2021.0 Yes
Hardware phoenixcontact plcnext_technology_starterkit - No
References