CVE-2024-28136 - PHOENIX CONTACT: command injection gains root privileges using the OCPP remote service

Back Back to CVE browser

HIGH

PHOENIX CONTACT: command injection gains root privileges using the OCPP remote service

Published May 14, 2024

7.8

HIGH

CVSS 3.1

EPSS 0.75%

Description

A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service.

Affected products

Vendor Phoenix Contact Product Charx Sec-3000 Default
unaffected
Affected
- ≥ 0, ≤ 1.5.1
Vendor Phoenix Contact Product Charx Sec-3050 Default
unaffected
Affected
- ≥ 0, ≤ 1.5.1
Vendor Phoenix Contact Product Charx Sec-3100 Default
unaffected
Affected
- ≥ 0, ≤ 1.5.1
Vendor Phoenix Contact Product Charx Sec-3150 Default
unaffected
Affected
- ≥ 0, ≤ 1.5.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Phoenix Contact	Charx Sec-3000	unaffected	Affected ≥ 0, ≤ 1.5.1
Phoenix Contact	Charx Sec-3050	unaffected	Affected ≥ 0, ≤ 1.5.1
Phoenix Contact	Charx Sec-3100	unaffected	Affected ≥ 0, ≤ 1.5.1
Phoenix Contact	Charx Sec-3150	unaffected	Affected ≥ 0, ≤ 1.5.1

Vendor Phoenixcontact Product Charx Sec 3000 Default
unknown
Affected
- ≥ 0, ≤ 1.5.1
Vendor Phoenixcontact Product Charx Sec 3050 Default
unknown
Affected
- ≥ 0, ≤ 1.5.1
Vendor Phoenixcontact Product Charx Sec 3100 Default
unknown
Affected
- ≥ 0, ≤ 1.5.1
Vendor Phoenixcontact Product Charx Sec 3150 Default
unknown
Affected
- ≥ 0, ≤ 1.5.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Phoenixcontact	Charx Sec 3000	unknown	Affected ≥ 0, ≤ 1.5.1
Phoenixcontact	Charx Sec 3050	unknown	Affected ≥ 0, ≤ 1.5.1
Phoenixcontact	Charx Sec 3100	unknown	Affected ≥ 0, ≤ 1.5.1
Phoenixcontact	Charx Sec 3150	unknown	Affected ≥ 0, ≤ 1.5.1