CVE-2024-26002
Assigner: CERTVDE
Published: 2024-03-12T08:12:13.841Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: CHARX SEC-3000
vendor: PHOENIX CONTACT
versions: lessThanOrEqual: 1.5.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CHARX SEC-3050
vendor: PHOENIX CONTACT
versions: lessThanOrEqual: 1.5.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CHARX SEC-3100
vendor: PHOENIX CONTACT
versions: lessThanOrEqual: 1.5.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CHARX SEC-3150
vendor: PHOENIX CONTACT
versions: lessThanOrEqual: 1.5.0
status: affected
version: 0
versionType: semver
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Peter Geissler
type: finder
user: 00000000-0000-4000-9000-000000000000
value: Rick De Jager
type: finder
user: 00000000-0000-4000-9000-000000000000
value: Carlo Meijer
descriptions: supportingMedia: base64: no
type: text/html
value: An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files.
value: An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
source: advisory: VDE-2024-011
defect: CERT@VDE#64650
discovery: UNKNOWN
title: PHOENIX CONTACT: File ownership manipulation in CHARX Series
x_generator: engine: Vulnogram 0.1.0-dev