ZDI-24-519: (Pwn2Own) Phoenix Contact CHARX SEC-3100 Untrusted Search Path Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3100 devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-28133.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-519?
The severity of ZDI-24-519 is classified as a critical vulnerability due to its potential for privilege escalation.
How do I fix ZDI-24-519?
To fix ZDI-24-519, update the Phoenix Contact CHARX SEC-3100 devices to the latest firmware version provided by the vendor.
Who is affected by ZDI-24-519?
ZDI-24-519 affects installations of the Phoenix Contact CHARX SEC-3100 devices if they have local access to the system.
Can ZDI-24-519 be exploited remotely?
No, ZDI-24-519 requires local access to the target system for exploitation.
What are the potential impacts of ZDI-24-519?
The potential impacts of ZDI-24-519 include unauthorized privilege escalation, allowing an attacker to gain higher-level access to system functionalities.