CVE-2020-12524 Phoenix Contact BTP Touch Panels uncontrolled resource consumption
Attackers can cause Phoenix Contact BTP Touch Panels to become unresponsive and fail to update displays, disrupting industrial operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12524?
CVE-2020-12524 is a high-severity denial of service vulnerability in Phoenix Contact BTP Touch Panel, published on 2 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Uncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to become unresponsive and not accurately update the display content (Denial of Service).
Weakness: CWE-400
Which versions are affected by CVE-2020-12524?
It affects 3 products.
Products include Phoenixcontact Btp 2043w Firmware, Phoenixcontact Btp 2070w Firmware, Phoenixcontact Btp 2102w Firmware.
How do I fix CVE-2020-12524?
No fix has been published for CVE-2020-12524 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-12524 being exploited?
There is no known exploitation of CVE-2020-12524 in the wild and no public exploit code.
Sources
Also known as GHSA-55qw-8gmw-8c9w.