CVE-2024-26001

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26001
An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.

7.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cert.vde.com/en/advisories/VDE-2024-011 Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2024-011 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3050:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3100:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3150:-:*:*:*:*:*:*:*
History

24 Jan 2025, 07:15

Type Values Removed Values Added
Summary (en) An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization. (en) An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.
CWE CWE-20

23 Jan 2025, 18:47

Type Values Removed Values Added
CPE cpe:2.3:o:phoenixcontact:charx_sec-3050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3000:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3100:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3050:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3150:-:*:*:*:*:*:*:*
First Time Phoenixcontact
Phoenixcontact charx Sec-3100 Firmware
Phoenixcontact charx Sec-3000 Firmware
Phoenixcontact charx Sec-3100
Phoenixcontact charx Sec-3050 Firmware
Phoenixcontact charx Sec-3050
Phoenixcontact charx Sec-3150
Phoenixcontact charx Sec-3150 Firmware
Phoenixcontact charx Sec-3000
References () https://cert.vde.com/en/advisories/VDE-2024-011 - () https://cert.vde.com/en/advisories/VDE-2024-011 - Third Party Advisory
CWE CWE-787

21 Nov 2024, 09:01

Type Values Removed Values Added
Summary
  • (es) Un atacante remoto no autenticado puede escribir memoria fuera de los límites debido a una validación de entrada incorrecta en la pila MQTT. El ataque de fuerza bruta no siempre tiene éxito debido a la aleatorización de la memoria.
References () https://cert.vde.com/en/advisories/VDE-2024-011 - () https://cert.vde.com/en/advisories/VDE-2024-011 -

12 Mar 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-12 09:15

Updated : 2025-01-24 07:15

NVD link : CVE-2024-26001

Mitre link : CVE-2024-26001

CVE.ORG link : CVE-2024-26001

JSON object : View

Products Affected

phoenixcontact

  • charx_sec-3000
  • charx_sec-3150_firmware
  • charx_sec-3050_firmware
  • charx_sec-3000_firmware
  • charx_sec-3150
  • charx_sec-3050
  • charx_sec-3100_firmware
  • charx_sec-3100
CWE
CWE-787

Out-of-bounds Write