Zurück zur Übersicht

PHOENIX CONTACT: command injection on RAD-80211-XD(/HP-BUS)

VDE-2019-007
Last update
14.05.2025 14:28
Published at
25.03.2019 12:45
Vendor(s)
Phoenix Contact GmbH & Co. KG
External ID
VDE-2019-007
CSAF Document
Download

Summary

A WebHMI utility may be exploited by any logged in user allowing the execution of arbitrary OS commands on the server. This provides the opportunity for a command injection attack.

Impact

If vulnerability is exploited, the attacker may execute system level commands at will with administrative privileges.

Affected Product(s)

Model no. Product name Affected versions
RAD-80211-XD Firmware all versions
RAD-80211-XD/HP-BUS Firmware all versions

Vulnerabilities

Expand / Collapse all

Published
22.09.2025 14:57
Severity
8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
Summary

An issue was discovered on PHOENIX CONTACT RAD-80211-XD and RAD-80211-XD/HP-BUS devices. Command injection can occur in the WebHMI component.

References
cve.org | nvd.nist.gov

Mitigation

Customers using Phoenix Contact 802-11XD radio modules are recommended to operate the devices in closed networks or protected with a suitable firewall.
For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Application Note:

Remediation

The product has been removed from active maintenance due to obsolescence. For this reason, it is recommended that concerned customers upgrade to the active FL WLAN product line.

Revision History

Version Date Summary
1 25.03.2019 12:45 Initial revision.
2 06.11.2024 12:27 Fix: correct certvde domain, added alias, added self-reference
3 14.05.2025 14:28 Fix: version term, added distribution