CVE-2014-9195: Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function
Published Jan 17, 2015
·Updated
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.
Affected Software
7 affected components
Phoenixcontact-software Multiprog=5.0
Phoenixcontact-software Multiprog=5.0
Phoenixcontact-software Multiprog=5.0
Phoenixcontact-software Proconos Eclr
Phoenixcontact-software Proconos Eclr
Phoenixcontact-software Proconos Eclr
Phoenixcontact-software Proconos Eclr
Event History
Jan 17, 2015
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:59 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-9195?
CVE-2014-9195 has a high severity rating due to the potential for remote command execution by unauthenticated attackers.
2
How do I fix CVE-2014-9195?
To mitigate CVE-2014-9195, ensure that network segmentation is applied and restrict access to the application from untrusted networks.
3
What systems are affected by CVE-2014-9195?
CVE-2014-9195 affects Phoenix Contact Multiprog version 5.0 and various ProConOs configurations.
4
Can CVE-2014-9195 be exploited remotely?
Yes, CVE-2014-9195 can be exploited remotely due to the lack of authentication in the affected software.
5
What kind of attacks can be performed using CVE-2014-9195?
Exploitation of CVE-2014-9195 can lead to arbitrary command execution, allowing attackers to gain control over the affected systems.