CVE-2024-28135

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-28135
A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://cert.vde.com/en/advisories/VDE-2024-019 Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2024-019 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3050:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3100:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3150:-:*:*:*:*:*:*:*
History

24 Jan 2025, 07:15

Type Values Removed Values Added
CWE CWE-20
Summary (en) A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected. (en) A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.

23 Jan 2025, 18:54

Type Values Removed Values Added
First Time Phoenixcontact
Phoenixcontact charx Sec-3100 Firmware
Phoenixcontact charx Sec-3000 Firmware
Phoenixcontact charx Sec-3100
Phoenixcontact charx Sec-3050 Firmware
Phoenixcontact charx Sec-3050
Phoenixcontact charx Sec-3150
Phoenixcontact charx Sec-3150 Firmware
Phoenixcontact charx Sec-3000
CWE CWE-77
References () https://cert.vde.com/en/advisories/VDE-2024-019 - () https://cert.vde.com/en/advisories/VDE-2024-019 - Third Party Advisory
CPE cpe:2.3:o:phoenixcontact:charx_sec-3050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3000:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3100:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3050:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3150:-:*:*:*:*:*:*:*

21 Nov 2024, 09:05

Type Values Removed Values Added
Summary
  • (es) Un atacante remoto con pocos privilegios puede utilizar una vulnerabilidad de inyección de comandos en la API que realiza la ejecución remota de código como usuario de la aplicación debido a una validación de entrada incorrecta. La confidencialidad se ve parcialmente afectada.
References () https://cert.vde.com/en/advisories/VDE-2024-019 - () https://cert.vde.com/en/advisories/VDE-2024-019 -

14 May 2024, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-14 16:16

Updated : 2025-01-24 07:15

NVD link : CVE-2024-28135

Mitre link : CVE-2024-28135

CVE.ORG link : CVE-2024-28135

JSON object : View

Products Affected

phoenixcontact

  • charx_sec-3000
  • charx_sec-3150_firmware
  • charx_sec-3050_firmware
  • charx_sec-3000_firmware
  • charx_sec-3150
  • charx_sec-3050
  • charx_sec-3100_firmware
  • charx_sec-3100
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')