CVE-2023-3569

Summary

In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload a crafted XML file which causes a denial-of-service.

Affected Software

VendorProductVersion RangeStatus
PHOENIX CONTACTCLOUD CLIENT 1101T-TX/TX0 < 2.06.10affected
PHOENIX CONTACTTC CLOUD CLIENT 1002-4G0 < 2.07.2affected
PHOENIX CONTACTTC CLOUD CLIENT 1002-4G ATT0 < 2.07.2affected
PHOENIX CONTACTTC CLOUD CLIENT 1002-4G VZW0 < 2.07.2affected
PHOENIX CONTACTTC ROUTER 3002T-4G0 < 2.07.2affected
PHOENIX CONTACTTC ROUTER 3002T-4G ATT0 < 2.07.2affected
PHOENIX CONTACTTC ROUTER 3002T-4G VZW0 < 2.07.2affected

Weaknesses

  • CWE-776: CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References