CVE-2024-6788 - OpenCVE

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Phoenixcontact	Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 Charx Sec 3150

No data.

No data.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2024-022

History

Tue, 13 Aug 2024 17:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Phoenixcontact Phoenixcontact charx Sec 3000 Phoenixcontact charx Sec 3050 Phoenixcontact charx Sec 3100 Phoenixcontact charx Sec 3150
CPEs		cpe:2.3:a:phoenixcontact:charx_sec_3000:::::::: cpe:2.3:a:phoenixcontact:charx_sec_3050:::::::: cpe:2.3:a:phoenixcontact:charx_sec_3100:::::::: cpe:2.3:a:phoenixcontact:charx_sec_3150::::::::
Vendors & Products		Phoenixcontact Phoenixcontact charx Sec 3000 Phoenixcontact charx Sec 3050 Phoenixcontact charx Sec 3100 Phoenixcontact charx Sec 3150
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 13 Aug 2024 13:30:00 +0000

Type	Values Removed	Values Added
Description		A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.
Title		Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password
Weaknesses		CWE-1188
References		https://cert.vde.com/en/advisories/VDE-2024-022
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2024-08-13T13:15:03.120Z

Updated: 2024-08-13T16:50:38.588Z

Reserved: 2024-07-16T12:18:00.312Z

Link: CVE-2024-6788

Vulnrichment

Updated: 2024-08-13T16:47:20.822Z

NVD

Status : Awaiting Analysis

Published: 2024-08-13T14:15:16.457

Modified: 2024-08-13T17:11:53.553

Link: CVE-2024-6788

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-6788", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2024-07-16T12:18:00.312Z", "datePublished": "2024-08-13T13:15:03.120Z", "dateUpdated": "2024-08-13T16:50:38.588Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CHARX SEC-3000", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "1.6.3", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CHARX SEC-3050", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "1.6.3", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CHARX SEC-3100", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "1.6.3", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CHARX SEC-3150", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "1.6.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "McCaulay Hudson"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Alexander Plaskett"}, {"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "NCC Group"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user \u201cuser-app\u201d to the default password.</span><br>"}], "value": "A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user \u201cuser-app\u201d to the default password."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1188", "description": "CWE-1188 Insecure Default Initialization of Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2024-08-13T13:15:03.120Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2024-022"}], "source": {"advisory": "VDE-2024-022", "defect": ["CERT@VDE#641622"], "discovery": "UNKNOWN"}, "title": "Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "phoenixcontact", "product": "charx_sec_3150", "cpes": ["cpe:2.3:a:phoenixcontact:charx_sec_3000:*:*:*:*:*:*:*:*", "cpe:2.3:a:phoenixcontact:charx_sec_3050:*:*:*:*:*:*:*:*", "cpe:2.3:a:phoenixcontact:charx_sec_3100:*:*:*:*:*:*:*:*", "cpe:2.3:a:phoenixcontact:charx_sec_3150:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "1.6.3", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-13T16:40:42.748470Z", "id": "CVE-2024-6788", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T16:50:38.588Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6788", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-13T16:40:42.748470Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:phoenixcontact:charx_sec_3000:*:*:*:*:*:*:*:*", "cpe:2.3:a:phoenixcontact:charx_sec_3050:*:*:*:*:*:*:*:*", "cpe:2.3:a:phoenixcontact:charx_sec_3100:*:*:*:*:*:*:*:*", "cpe:2.3:a:phoenixcontact:charx_sec_3150:*:*:*:*:*:*:*:*"], "vendor": "phoenixcontact", "product": "charx_sec_3150", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T16:47:20.822Z"}}], "cna": {"title": "Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password", "source": {"defect": ["CERT@VDE#641622"], "advisory": "VDE-2024-022", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "McCaulay Hudson"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Alexander Plaskett"}, {"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "NCC Group"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PHOENIX CONTACT", "product": "CHARX SEC-3000", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "PHOENIX CONTACT", "product": "CHARX SEC-3050", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "PHOENIX CONTACT", "product": "CHARX SEC-3100", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "PHOENIX CONTACT", "product": "CHARX SEC-3150", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2024-022"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user \u201cuser-app\u201d to the default password.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user \u201cuser-app\u201d to the default password.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188 Insecure Default Initialization of Resource"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2024-08-13T13:15:03.120Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6788", "state": "PUBLISHED", "dateUpdated": "2024-08-13T16:50:38.588Z", "dateReserved": "2024-07-16T12:18:00.312Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2024-08-13T13:15:03.120Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}