ZDI-24-863: (Pwn2Own) Phoenix Contact CHARX SEC-3100 plctool Improper Privilege Management Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3100 devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-26002.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-863?
The severity of ZDI-24-863 is high due to its potential to allow local privilege escalation.
How do I fix ZDI-24-863?
To fix ZDI-24-863, update the affected Phoenix Contact CHARX SEC-3100 devices to the latest firmware provided by the vendor.
What type of access is required to exploit ZDI-24-863?
An attacker must obtain the ability to execute low-privileged code on the target system to exploit ZDI-24-863.
Which devices are affected by ZDI-24-863?
The vulnerability ZDI-24-863 specifically affects Phoenix Contact CHARX SEC-3100 devices.
What can attackers achieve by exploiting ZDI-24-863?
Exploiting ZDI-24-863 allows attackers to escalate their privileges on the affected installations.