HIGH🇵🇱 Wersja polska

CVE-2020-12517

CVSS 8.8v3.1pub. 2020-12-17upd. 2024-11-21

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Phoenixcontact Axc F 1152

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Axc F 2152

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Axc F 2152 Starterkit

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Axc F 3152

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Plcnext Firmware

    OS
    Phoenixcontact
    < 2021.0

  • Phoenixcontact Plcnext Technology Starterkit

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Rfc 4072s

    HW
    Phoenixcontact
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPEXSS
CWE
References

Related vulnerabilities

CVE-2023-46142HIGH8.8same product

A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote att...

CVE-2021-34570HIGH7.5same product

Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack t...

CVE-2020-12519HIGH8.8same product

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i...

CVE-2023-46144MEDIUM6.5same product

A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with lo...

CVE-2020-12521MEDIUM6.5same product

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead...