ZDI-24-857: (Pwn2Own) Phoenix Contact CHARX SEC-3100 Improper Access Control Firewall Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass firewall rules and access another interface on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.0. The following CVEs are assigned: CVE-2024-25996.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-857?
The vulnerability ZDI-24-857 has a CVSS rating of 5.0, indicating moderate severity.
What type of vulnerability is ZDI-24-857?
ZDI-24-857 is a vulnerability that allows network-adjacent attackers to bypass firewall rules on Phoenix Contact CHARX SEC-3100 devices.
Who can exploit ZDI-24-857?
ZDI-24-857 can be exploited by network-adjacent attackers without needing any authentication.
What devices are affected by ZDI-24-857?
The affected devices for vulnerability ZDI-24-857 are Phoenix Contact CHARX SEC-3100.
How do I fix ZDI-24-857?
To mitigate ZDI-24-857, you should apply any available security updates from the vendor, Phoenix Contact.