ZDI-CAN-23305: ZDI-24-863: (Pwn2Own) Phoenix Contact CHARX SEC-3100 plctool Improper Privilege Management Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3100 devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-26002.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-23305?
The severity of ZDI-CAN-23305 is critical due to its ability to allow local privilege escalation on affected devices.
How do I fix ZDI-CAN-23305?
To fix ZDI-CAN-23305, promptly apply the latest security patches provided by Phoenix Contact for CHARX SEC-3100 devices.
Who is affected by ZDI-CAN-23305?
ZDI-CAN-23305 affects installations of Phoenix Contact CHARX SEC-3100 devices where local attackers can exploit the vulnerability.
What type of attack vector is involved in ZDI-CAN-23305?
ZDI-CAN-23305 involves a local attack vector requiring the attacker to execute low-privileged code before escalation.
What are the potential consequences of ZDI-CAN-23305?
The potential consequences of ZDI-CAN-23305 include unauthorized access and control over sensitive functionalities of the device.