{"containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ProConOs", "vendor": "Phoenix Contact", "versions": [{"status": "affected", "version": "All versions"}]}, {"defaultStatus": "unaffected", "product": "MultiProg", "vendor": "Phoenix Contact", "versions": [{"status": "affected", "version": "All versions"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Reid Wightman of Digital Bond"}], "datePublic": "2015-01-13T07:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.</p>"}], "value": "Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic."}], "metrics": [{"cvssV2_0": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-09-05T21:03:14.656Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-03"}, {"name": "37066", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/37066/"}], "source": {"advisory": "ICSA-15-013-03", "discovery": "EXTERNAL"}, "title": "Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Phoenix Contact Software designed the applications and protocols without\n authentication mechanisms. It is the understanding of Phoenix Contact \nSoftware that vendors using the application software and its protocol \nwould incorporate its own authentication mechanism in its final product.\n Phoenix Contact Software is considering adding authentication software \ninto future versions of its application software and its protocol.\n\n<br>"}], "value": "Phoenix Contact Software designed the applications and protocols without\n authentication mechanisms. It is the understanding of Phoenix Contact \nSoftware that vendors using the application software and its protocol \nwould incorporate its own authentication mechanism in its final product.\n Phoenix Contact Software is considering adding authentication software \ninto future versions of its application software and its protocol."}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2014-9195", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://ics-cert.us-cert.gov/advisories/ICSA-15-013-03", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-013-03"}, {"name": "37066", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/37066/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T13:40:24.556Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-013-03"}, {"name": "37066", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/37066/"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2014-9195", "datePublished": "2015-01-17T02:00:00", "dateReserved": "2014-12-02T00:00:00", "dateUpdated": "2025-09-05T21:03:14.656Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phoenixcontact-software:multiprog:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "256CB792-CEAB-4036-94D2-5A0219E034C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:phoenixcontact-software:multiprog:5.0:*:*:*:express:*:*:*", "matchCriteriaId": "B9C6954C-A0F8-4E5A-BD5E-F78D4B73DBA7", "vulnerable": true}, {"criteria": "cpe:2.3:a:phoenixcontact-software:multiprog:5.0:*:*:*:pro\\+:*:*:*", "matchCriteriaId": "8EC2041D-521F-4706-B2DF-EE11DFD37B90", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF36F6F3-3213-4959-A80D-C84B7919B8E8", "vulnerable": true}, {"criteria": "cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:single_chip:*:*:*", "matchCriteriaId": "B902DE84-82D2-4561-AAFF-177F698714CD", "vulnerable": true}, {"criteria": "cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:softplc:*:*:*", "matchCriteriaId": "C57B1599-F4FC-48C3-8CF8-804A42387777", "vulnerable": true}, {"criteria": "cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:visual_studio:*:*:*", "matchCriteriaId": "7C195310-9DA0-4B43-B476-702ED8799844", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic."}, {"lang": "es", "value": "Phoenix Contact ProConOs y MultiProg no requieren autenticaci\u00f3n, lo que permite a atacantes remotos ejecutar comandos arbitrarios a trav\u00e9s de trafico conforme con el protocolo."}], "id": "CVE-2014-9195", "lastModified": "2025-09-05T21:15:32.540", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "ics-cert@hq.dhs.gov", "type": "Secondary", "userInteractionRequired": false}, {"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-01-17T02:59:05.630", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-03"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/37066/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-013-03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/37066/"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-255"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{}