THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-28134

PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series

Reserved:2024-03-05
Published:2024-05-14
Updated:2024-05-14

Description

An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected.



HIGH: 7.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Problem types

CWE-319 Cleartext Transmission of Sensitive Information

Product status

Default status
unaffected

Any version
affected

Default status
unaffected

Any version
affected

Default status
unaffected

Any version
affected

Default status
unaffected

Any version
affected

Credits

Trend Micro's Zero Day Initiative reporter

Summoning Team reporter

Sina Kheirkhah finder

References

https://cert.vde.com/en/advisories/VDE-2024-019

cve.org CVE-2024-28134

nvd.nist.gov CVE-2024-28134

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-28134