ZDI-CAN-20923: ZDI-24-523: Phoenix Contact CHARX SEC-3100 Link Following Local Privilege Escalation Vulnerability

Published May 29, 2024

Updated

This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3100 charging controllers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-28137.

Affected Software

1 affected component

Phoenix Contact CHARX SEC-3100

Event History

May 29, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-20923?

ZDI-CAN-20923 has a critical severity rating due to its potential for privilege escalation.

How do I fix ZDI-CAN-20923?

To fix ZDI-CAN-20923, you should apply the latest firmware updates provided by Phoenix Contact for the CHARX SEC-3100.

Who is affected by ZDI-CAN-20923?

ZDI-CAN-20923 affects installations of the Phoenix Contact CHARX SEC-3100 charging controllers.

What type of attack leverages ZDI-CAN-20923?

ZDI-CAN-20923 can be exploited by local attackers who have access to execute low-privileged code.

What are the prerequisites for exploiting ZDI-CAN-20923?

An attacker must first gain the ability to execute low-privileged code on the target system to exploit ZDI-CAN-20923.