CVE-2023-3569

In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload a crafted XML file which causes a denial-of-service.

Score

CVSS 3.1 4.9 Medium

Status

Modified - info@cert.vde.com

Published

2023-08-08

Last modified

2025-02-27

Weaknesses

CWE-776

Affected products

• Cloud Client 1101t-txtx (Phoenix Contact)
• Tc Cloud Client 1002-4g (Phoenix Contact)
• Tc Cloud Client 1002-4g Att (Phoenix Contact)
• Tc Cloud Client 1002-4g Vzw (Phoenix Contact)
• Tc Router 3002t-4g (Phoenix Contact)
• Tc Router 3002t-4g Att (Phoenix Contact)
• Tc Router 3002t-4g Vzw (Phoenix Contact)
• Cloud Client 1101t-tx Firmware (Phoenixcontact)
• Tc Cloud Client 1002-4g Att Firmware (Phoenixcontact)
• Tc Cloud Client 1002-4g Firmware (Phoenixcontact)
• Tc Cloud Client 1002-4g Vzw Firmware (Phoenixcontact)
• Tc Router 3002t-4g Att Firmware (Phoenixcontact)
• Tc Router 3002t-4g Firmware (Phoenixcontact)
• Tc Router 3002t-4g Vzw Firmware (Phoenixcontact)

References

• http://packetstormsecurity.com/files/174152/Phoenix-Contact-TC-Cloud-TC-Router-2.x-XSS-Memory-Consumption.html
• http://seclists.org/fulldisclosure/2023/Aug/12
• https://cert.vde.com/en/advisories/VDE-2023-017