CVE-2024-25995: (Pwn2Own) Phoenix Contact CHARX SEC-3100 Config Manager Improper Input Validation Remote Code Execution Vulnerability
An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation.
Other sources
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CharxSystemConfigManager service, which listens on TCP port 5001 by default. The issue results from the lack of proper validation of a user-supplied string before using it to update a configuration. An attacker can leverage this vulnerability to execute code in the context of the service account.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25995?
CVE-2024-25995 has a critical severity rating due to its potential for remote code execution.
How do I fix CVE-2024-25995?
To fix CVE-2024-25995, update the affected Phoenix Contact CHARX Series firmware to version 1.5.1 or later.
What could an attacker do if they exploit CVE-2024-25995?
An attacker exploiting CVE-2024-25995 could gain root rights, execute arbitrary code, or perform a denial-of-service attack.
Which products are affected by CVE-2024-25995?
CVE-2024-25995 affects several models in the Phoenix Contact CHARX Series, including the CHARX SEC-3100 and related firmware versions.
Is authentication required to exploit CVE-2024-25995?
No, CVE-2024-25995 can be exploited by unauthenticated remote attackers.