CVE-2024-26001: PHOENIX CONTACT: Out of bounds write only memory access
Published Mar 12, 2024
·Updated
An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.
Affected Software
8 affected components
All of the following
Phoenixcontact Charx Sec-3000 Firmware<1.5.1
Phoenixcontact Charx Sec-3000
All of the following
Phoenixcontact Charx Sec-3050 Firmware<1.5.1
Phoenixcontact Charx Sec-3050
All of the following
Phoenixcontact Charx Sec-3100 Firmware<1.5.1
Phoenixcontact Charx Sec-3100
All of the following
Phoenixcontact Charx Sec-3150 Firmware<1.5.1
Phoenixcontact Charx Sec-3150
Event History
Mar 12, 2024
CVE Published
via MITRE·08:12 AM
Data Sourced
via MITRE·08:12 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-26001?
CVE-2024-26001 has a high severity due to an unauthenticated remote attack potential.
2
How do I fix CVE-2024-26001?
To fix CVE-2024-26001, update the vulnerable Phoenix Contact CHARX SEC firmware to version 1.5.1 or later.
3
What systems are affected by CVE-2024-26001?
CVE-2024-26001 affects the Phoenixcontact CHARX SEC-3000, 3050, 3100, and 3150 firmware versions prior to 1.5.1.
4
Can CVE-2024-26001 be exploited remotely?
Yes, CVE-2024-26001 can be exploited remotely due to improper input validation in the MQTT stack.
5
Is there a workaround for CVE-2024-26001?
There are no specific workarounds listed for CVE-2024-26001, so upgrading the firmware is the recommended action.