CVE-2024-3913

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-3913
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cert.vde.com/en/advisories/VDE-2024-022 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3150:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3100:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3050:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3000:-:*:*:*:*:*:*:*
History

13 Sep 2024, 15:58

Type Values Removed Values Added
CPE cpe:2.3:o:phoenixcontact:charx_sec-3050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3100:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3050:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3150:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3000:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3000_firmware:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 5.3
References () https://cert.vde.com/en/advisories/VDE-2024-022 - () https://cert.vde.com/en/advisories/VDE-2024-022 - Third Party Advisory
First Time Phoenixcontact charx Sec-3100 Firmware
Phoenixcontact
Phoenixcontact charx Sec-3100
Phoenixcontact charx Sec-3050 Firmware
Phoenixcontact charx Sec-3050
Phoenixcontact charx Sec-3000 Firmware
Phoenixcontact charx Sec-3150
Phoenixcontact charx Sec-3150 Firmware
Phoenixcontact charx Sec-3000
Summary
  • (es) Un atacante remoto no autenticado puede utilizar esta vulnerabilidad para cambiar la configuración del dispositivo debido a un archivo que se puede escribir durante un breve período de tiempo después del inicio del sistema.

13 Aug 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-13 13:15

Updated : 2024-09-13 15:58

NVD link : CVE-2024-3913

Mitre link : CVE-2024-3913

CVE.ORG link : CVE-2024-3913

JSON object : View

Products Affected

phoenixcontact

  • charx_sec-3100_firmware
  • charx_sec-3150
  • charx_sec-3050_firmware
  • charx_sec-3000_firmware
  • charx_sec-3150_firmware
  • charx_sec-3100
  • charx_sec-3050
  • charx_sec-3000
CWE
CWE-552

Files or Directories Accessible to External Parties