ZDI-CAN-23221: ZDI-24-857: (Pwn2Own) Phoenix Contact CHARX SEC-3100 Improper Access Control Firewall Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass firewall rules and access another interface on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.0. The following CVEs are assigned: CVE-2024-25996.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-23221?
The severity of ZDI-CAN-23221 is rated at 5.0 on the CVSS scale.
How do I fix ZDI-CAN-23221?
To mitigate ZDI-CAN-23221, ensure that firewall rules are properly configured and consider restricting access to the affected device interfaces.
Who is affected by ZDI-CAN-23221?
ZDI-CAN-23221 affects installations of Phoenix Contact CHARX SEC-3100 devices.
Can ZDI-CAN-23221 be exploited remotely?
Yes, ZDI-CAN-23221 can be exploited by network-adjacent attackers without requiring authentication.
What type of vulnerability is ZDI-CAN-23221?
ZDI-CAN-23221 is a vulnerability that allows bypassing of firewall rules.