CVE-2024-28134 PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series

High 7.0 Published 14 May 2024 Updated 2 Aug 2024

An attacker can perform a Man-in-the-Middle attack to steal session tokens and gain unauthorized web management access on PHOENIX CONTACT CHARX devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-28134?

CVE-2024-28134 is a high-severity vulnerability in PHOENIX CONTACT CHARX SEC-3000, published on 14 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected.

Weakness: CWE-319

Which versions are affected by CVE-2024-28134?

It affects 4 products.

Products include Phoenixcontact Charx Sec-3000 Firmware, Phoenixcontact Charx Sec-3050 Firmware, Phoenixcontact Charx Sec-3100 Firmware, Phoenixcontact Charx Sec-3150 Firmware.

How do I fix CVE-2024-28134?

No fix has been published for CVE-2024-28134 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-28134 being exploited?

There is no known exploitation of CVE-2024-28134 in the wild and no public exploit code.

Sources

Also known as GHSA-hvrj-9f39-j96h.