IM
IronMonkey Threat Research

CVE-2014-9195 HIGH

Published: 2015-01-17 | Last Modified: 2026-06-17 | Status: Modified

Description

Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.

Additional Descriptions (1)

Phoenix Contact ProConOs y MultiProg no requieren autenticación, lo que permite a atacantes remotos ejecutar comandos arbitrarios a través de trafico conforme con el protocolo.

CVSS Metrics

Base Score: 7.5 (HIGH)

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 6.4

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-306
[email protected] Secondary
en CWE-255

Affected Products

Vendor Product Version Update Type
phoenixcontact-software multiprog 5.0 <built-in method update of dict object at 0x7fd36a715500> Application
phoenixcontact-software multiprog 5.0 <built-in method update of dict object at 0x7fd36bea4680> Application
phoenixcontact-software multiprog 5.0 <built-in method update of dict object at 0x7fd2a123db00> Application
phoenixcontact-software proconos_eclr * <built-in method update of dict object at 0x7fd38444c740> Operating System
phoenixcontact-software proconos_eclr * <built-in method update of dict object at 0x7fd36a714580> Operating System
phoenixcontact-software proconos_eclr * <built-in method update of dict object at 0x7fd36bd0afc0> Operating System
phoenixcontact-software proconos_eclr * <built-in method update of dict object at 0x7fd340c2c240> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:phoenixcontact-software:multiprog:5.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:phoenixcontact-software:multiprog:5.0:*:*:*:express:*:*:*
Yes cpe:2.3:a:phoenixcontact-software:multiprog:5.0:*:*:*:pro\+:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:single_chip:*:*:*
Yes cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:softplc:*:*:*
Yes cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:visual_studio:*:*:*

References