CVE-2024-28134
Assigner: CERTVDE
Published: 2024-05-14T08:09:24.900Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: CHARX SEC-3000
vendor: PHOENIX CONTACT
versions: lessThanOrEqual: 1.5.1
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CHARX SEC-3050
vendor: PHOENIX CONTACT
versions: lessThanOrEqual: 1.5.1
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CHARX SEC-3100
vendor: PHOENIX CONTACT
versions: lessThanOrEqual: 1.5.1
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CHARX SEC-3150
vendor: PHOENIX CONTACT
versions: lessThanOrEqual: 1.5.1
status: affected
version: 0
versionType: semver
credits: type: reporter
user: 00000000-0000-4000-9000-000000000000
value: Trend Micro's Zero Day Initiative
type: reporter
user: 00000000-0000-4000-9000-000000000000
value: Summoning Team
type: finder
user: 00000000-0000-4000-9000-000000000000
value: Sina Kheirkhah
descriptions: supportingMedia: base64: no
type: text/html
value: 

	
		
		
	
	
		<div>
			<div>
				<div>
					<p>

	
		
		
	
	
		</p><div>
			<div>
				<div>
					<p>An unauthenticated remote attacker can extract a session token with a MitM attack and gain&nbsp;web-based
management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. <span style="background-color: rgb(255, 255, 255);">No additional user interaction is required.&nbsp;</span>The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected.&nbsp;<br></p></div></div></div></div>
			</div>
		</div>
	

value: 
	
		
		
	
	
		
			
				
					

	
		
		
	
	
		


			
				
					An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based
management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected. 











			


		


	

metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
type: CWE
source: advisory: VDE-2024-019
defect: CERT@VDE#64664
discovery: UNKNOWN
title: PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series 
x_generator: engine: Vulnogram 0.1.0-dev