Critical severity · published Feb 26, 2019
CVE-2019-9201
Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the…
9.8
CVSS
3.1%
EPSS
No
On KEV
Description
Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A1
Axc 1050 Firmware · Phoenixcontact
All versions, or not specified · source: NVD
I1
Ilc 131 Eth Firmware · Phoenixcontact
All versions, or not specified · source: NVD
I1
Ilc 131 Eth/xc Firmware · Phoenixcontact
All versions, or not specified · source: NVD
I1
Ilc 151 Eth Firmware · Phoenixcontact
All versions, or not specified · source: NVD
I1
Ilc 151 Eth/xc Firmware · Phoenixcontact
All versions, or not specified · source: NVD
I1
Ilc 171 Eth 2tx Firmware · Phoenixcontact
All versions, or not specified · source: NVD
I1
Ilc 191 Eth 2tx Firmware · Phoenixcontact
All versions, or not specified · source: NVD
I1
Ilc 191 Me/an Firmware · Phoenixcontact
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-9201
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-9201
Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2019-015/
Exploit
https://medium.com/%40SergiuSechel/misconfiguration-in-ilc-gsm-gprs-devices-leaves-over-1-200-ics-devices-vulnerable-to-attacks-over-82c2d4a91561
More from Axc 1050 Firmware
9.8
CVE-2023-46141
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full…
9.8
CVE-2022-31800
An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device
7.5
CVE-2023-46143
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC