PHOENIX CONTACT FL SWITCH 3xxx series, FL SWITCH 4xxx series, and FL SWITCH 48xx series products running firmware version 1.0 to 1.32 allow unauthenticated users with network access to gain administrative privileges (CVE-2017-16743) and expose information to unauthenticated users in Monitor Mode (CVE-2017-16741).

CVE-2017-16743: web-service authentication bypass, improper authorization (CWE-285)

By crafting HTTP Set-Cookie and POST requests, an unauthenticated attacker with network access may bypass the web-service authentication and gain administrative privileges on the managed switch devices.

CVE-2017-16741: information exposure (CWE-200)

Any user with network access to a managed switch device may use Monitor Mode to read diagnostic information from the device's web interface without prior authentication in the web GUI. This includes information about model, subnet mask, uptime, and utilisation.

Customers using PHOENIX CONTACT FL SWITCH 3xxx series, FL SWITCH 4xxx series and FL SWITCH 48xx series devices with firmware versions up to 1.32 are recommended to update to firmware version 1.33 or higher, which fixes these vulnerabilities. The updated firmware may be downloaded from the following managed switch product pages on the vendor's website:

Ilya Karpov and Evgeniy Druzhinin (Positive Technologies) reported these vulnerabilities to PHOENIX CONTACT.