Back to overview

PHOENIX CONTACT: Local Privilege Escalation in Portico Remote desktop control software

VDE-2020-013
Last update
03/27/2020 10:48
Published at
03/27/2020 10:48
Vendor(s)
Phoenix Contact GmbH & Co. KG
External ID
VDE-2020-013
CSAF Document
Download

Summary

If the software runs as a service, a user with limited access can gain administrator privileges by starting a shell with administrator rights from the Import / Export configuration dialog.

Impact

A malicious user could use this vulnerability to gain administrator privileges on the Computer running the Portico software.

Affected Product(s)

Model no. Product name Affected versions
PORTICO SERVER 4 CLIENT <=3.0.7 PORTICO SERVER 4 CLIENT <=3.0.7
Software PORTICO SERVER 1 CLIENT <=3.0.7 Software PORTICO SERVER 1 CLIENT <=3.0.7
Software PORTICO SERVER 16 CLIENT <=3.0.7 Software PORTICO SERVER 16 CLIENT <=3.0.7

Vulnerabilities

Expand / Collapse all

Published
09/22/2025 14:57
Severity
7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
Improper Privilege Management (CWE-269)
Summary

Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.

References
cve.org | nvd.nist.gov

Remediation

Phoenix Contact strongly recommends users to upgrade to Portico V3.0.8 or higher which fixes this vulnerability. The current version of Portico is available on the Phoenix Contact website external link.

Phoenix Contact strongly recommends protection measures against unauthorized access for network-compatible devices, solutions and PC-based software. For detailed information please refer to our application note:

Measures to protect network-compatible devices with communication interfaces, solutions and PC-based software against unauthorized access external link

Revision History

Version Date Summary
1 03/27/2020 10:48 Initial revision.