SCADA Vulnerabilities & Exposures (SVE)

CRITIFENCE® SCADA Vulnerabilities and Exposures Database (SVE)

[SVE-543039185] PHOENIX CONTACT FL COMSERVER, FL COM SERVER, and PSI-MODEM/ETH

Date Type Platform Author EDB-ID CVE-ID OSVDB-ID Download App SIS Signature
2017-12-07OtherPHOENIX CONTACTMaxim Rupp reported the vulnerability to ICS-CERT. CERT@VDEN/ACVE-2017-1672 N/AN/AN/A

Source

						
							
								
#
# PHOENIX CONTACT FL COMSERVER, FL COM SERVER, and PSI-MODEM/ETH
#


### VULNERABLE VENDOR
PHOENIX CONTACT


### VULNERABLE PRODUCT
FL COMSERVER, FL COM SERVER, and PSI-MODEM/ETH 


### RESEARCHER
Maxim Rupp reported the vulnerability to ICS-CERT. CERT@VDE


### AFFECTED PRODUCTS
The following models running firmware versions prior to 1.99, 2.20, or 2.40 of FL COMSERVER, FL COM SERVER, and PSI-MODEM/ETH, industrial networking equipment, are affected:

FL COMSERVER BASIC 232/422/485,
FL COMSERVER UNI 232/422/485,
FL COMSERVER BAS 232/422/485-T,
FL COMSERVER UNI 232/422/485-T,
FL COM SERVER RS232,
FL COM SERVER RS485, and
PSI-MODEM/ETH


### IMPACT
Successful exploitation of this vulnerability may allow a remote attacker to change configuration variables on the device.


### VULNERABILITY OVERVIEW
IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
The cross-site scripting vulnerability has been identified, which may allow remote code execution.
CVE-2017-16723 has been assigned to this vulnerability.
A CVSS v3 base score of 8.2 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H)





### BACKGROUND
Critical Infrastructure Sectors: Communications, Critical Manufacturing, Information Technology
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany




### MITIGATION

PHOENIX CONTACT has released new firmware versions for the affected devices. The latest download links can be found at:

https://cert.vde.com/de-de/advisories/vde-2017-004