CVE-2014-9195

Summary

Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.

Affected Software

Weaknesses

• CWE-306: CWE-306

Workarounds

Phoenix Contact Software designed the applications and protocols without authentication mechanisms. It is the understanding of Phoenix Contact Software that vendors using the application software and its protocol would incorporate its own authentication mechanism in its final product. Phoenix Contact Software is considering adding authentication software into future versions of its application software and its protocol.

ADP Enrichment

CVE Program Container

Additional References

• https://ics-cert.us-cert.gov/advisories/ICSA-15-013-03
• https://www.exploit-db.com/exploits/37066/

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-03
• https://www.exploit-db.com/exploits/37066/

• ←Previous
• Next→