CVE-2023-3526

Katalog CVE

CVSS 9.6 · Critical EPSS 1,8%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada phoenixcontact cloud client 1101t-tx firmware, phoenixcontact tc cloud client 1002-4g att firmware +5 lainnya. Skor CVSS 3.1 9.6 (Critical) menurut cert.vde.com.

Deskripsi (NVD)

In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser.

Rincian

Terbit di NVD

8 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.6 (Critical), sumber cert.vde.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert.vde.com/en/advisories/VDE-2023-017 advisory pihak ketiga
• http://packetstormsecurity.com/files/174152/Phoenix-Contact-TC-Cloud-TC-Router-2.x-XSS-Memory-Consumption.html
• http://seclists.org/fulldisclosure/2023/Aug/12