CVE-2023-3569

Katalog CVE

CVSS 4.9 · Medium EPSS 1,4%

Kerentanan Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') pada phoenixcontact cloud client 1101t-tx firmware, phoenixcontact tc cloud client 1002-4g att firmware +5 lainnya. Skor CVSS 3.1 4.9 (Medium) menurut cert.vde.com.

Deskripsi (NVD)

In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload a crafted XML file which causes a denial-of-service.

Rincian

Terbit di NVD

8 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber cert.vde.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert.vde.com/en/advisories/VDE-2023-017 advisory pihak ketiga
• http://packetstormsecurity.com/files/174152/Phoenix-Contact-TC-Cloud-TC-Router-2.x-XSS-Memory-Consumption.html
• http://seclists.org/fulldisclosure/2023/Aug/12