ZDI-CAN-23419: ZDI-24-519: (Pwn2Own) Phoenix Contact CHARX SEC-3100 Untrusted Search Path Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3100 devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-28133.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-23419?
The severity of ZDI-CAN-23419 is critical, as it allows local privilege escalation on affected devices.
How do I fix ZDI-CAN-23419?
To fix ZDI-CAN-23419, update the Phoenix Contact CHARX SEC-3100 firmware to the latest version provided by the vendor.
Who is affected by ZDI-CAN-23419?
ZDI-CAN-23419 affects installations of Phoenix Contact CHARX SEC-3100 devices.
What type of vulnerability is ZDI-CAN-23419?
ZDI-CAN-23419 is a local privilege escalation vulnerability.
What must an attacker do to exploit ZDI-CAN-23419?
An attacker must first gain the ability to execute low-privileged code on the target system to exploit ZDI-CAN-23419.