Phoenix Contact vulnerabilities
193 CVEs and advisories name Phoenix Contact as an affected vendor, newest first. Follow it as a feed.
- CVE-2020-12521Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: A specially crafted LLDP packet may lead to a high system load in the PROFINET stack.
- CVE-2020-12519Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use this vulnerability i.e. to open a reverse shell with root privileges.
- CVE-2020-12518Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.
- CVE-2020-12517Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).
- CVE-2020-12524Phoenix Contact BTP Touch Panels uncontrolled resource consumption
- CVE-2020-12499PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier: Improper path sanitation vulnerability.
- CVE-2020-12498Phoenix Contact Automation Worx <= 1.87: out-of-bounds read remote code execution
- CVE-2020-12497Phoenix Contact Automation Worx <= 1.87: stack-based overflow
- CVE-2019-10953ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions.
- CVE-2016-8380The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication.
- CVE-2016-8371The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled.
- CVE-2016-8366Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI p
- CVE-2014-9195Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function