CVE-2018-13991 Information disclosure in n/a

What is CVE-2018-13991?

CVE-2018-13991 is a medium-severity vulnerability in n/a, published on 7 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 leaks private information in firmware images.

Weakness: CWE-200

Which versions are affected by CVE-2018-13991?

It affects 29 products.

Products include Phoenixcontact Fl Switch 3004t-Fx Firmware, Phoenixcontact Fl Switch 3004t-Fx St Firmware, Phoenixcontact Fl Switch 3005 Firmware, Phoenixcontact Fl Switch 3005t Firmware, Phoenixcontact Fl Switch 3006t-2fx Firmware, Phoenixcontact Fl Switch 3006t-2fx Sm Firmware and 23 more.

How do I fix CVE-2018-13991?

No fix has been published for CVE-2018-13991 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-13991 being exploited?

There is no known exploitation of CVE-2018-13991 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-16743 Auth bypass in PHOENIX CONTACT FL SWITCH Critical 9.8
• CVE-2018-10730 Command injection in n/a Critical 9.1
• CVE-2018-10731 Memory corruption in n/a Critical 9.0
• CVE-2018-13993 Cross-site request forgery in n/a High 8.8
• CVE-2018-13990 Auth bypass in n/a High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-62xj-w7jf-v2q8.