CVE-2016-8366 Hardcoded credentials in Phoenix Contact ILC PLCs
Attackers can bypass HMI page protection on Phoenix Contact ILC PLCs if the password macro is configured to store credentials in clear text.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-8366?
CVE-2016-8366 is a high-severity vulnerability in Phoenix Contact ILC PLCs, published on 5 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by the user. The password macro can be configured in a way that the password is stored and transferred in clear text.
Which versions are affected by CVE-2016-8366?
It affects 1 product.
Products include Phoenixcontact Ilc Plcs Firmware.
How do I fix CVE-2016-8366?
No fix has been published for CVE-2016-8366 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-8366 being exploited?
There is no known exploitation of CVE-2016-8366 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Phoenix Contact ILC PLCs
Sources
Also known as GHSA-mfgp-7r52-jcjh.