CVE-2024-26000: PHOENIX CONTACT: Out of bounds read only memory access
First published: Tue Mar 12 2024(Updated: )
An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.
Credit: info@cert.vde.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Phoenix Contact CHARX SEC-3000 | <1.5.1 | |
| Phoenix Contact CHARX SEC-3000 | ||
| All of | ||
| Phoenix Contact CHARX SEC-3050 Firmware | <1.5.1 | |
| Phoenix Contact CHARX SEC-3050 | ||
| All of | ||
| Phoenix Contact CHARX SEC-3100 | <1.5.1 | |
| Phoenix Contact CHARX SEC-3100 | ||
| All of | ||
| PhoenixContact CHARX SEC-3150 Firmware | <1.5.1 | |
| Phoenix Contact CHARX SEC-3150 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-26000?
CVE-2024-26000 is classified as a high severity vulnerability due to its ability to allow unauthenticated remote attackers to read memory out of bounds.
How do I fix CVE-2024-26000?
To fix CVE-2024-26000, it is recommended to update the firmware of affected devices to the latest version beyond 1.5.1.
Which devices are affected by CVE-2024-26000?
CVE-2024-26000 affects the Phoenix Contact CHARX SEC-3000, 3050, 3100, and 3150 firmware versions prior to 1.5.1.
What are the potential impacts of CVE-2024-26000?
The impacts of CVE-2024-26000 include unauthorized access to sensitive memory information, potentially leading to system compromise.
Is there a workaround for CVE-2024-26000?
Currently, no specific workarounds are recommended for CVE-2024-26000; updating to a secure firmware version is the primary mitigation.
- agent/references
- agent/title
- agent/first-publish-date
- agent/type
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/phoenixcontact
- canonical/phoenix contact charx sec-3000
- canonical/phoenix contact charx sec-3050 firmware
- canonical/phoenix contact charx sec-3050
- canonical/phoenix contact charx sec-3100
- canonical/phoenixcontact charx sec-3150 firmware
- canonical/phoenix contact charx sec-3150