Summary
An undocumented password protected FTP access to the root directory exists in certain devices of the AXL F BK and IL BK product families (CWE-798).
Impact
An attacker who was able to obtain the hard-coded password to FTP access could access the FTP area and read the scrambled monitoring information of the device.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| 2688394 | AXL F BK EIP (HW < 05) | Firmware <1.30 |
| 2702782 | AXL F BK EIP EF (HW < 01) | Firmware <1.30 |
| 2688459 | AXL F BK ETH (HW < 05) | Firmware FW1.30, HW 01 |
| 2702177 | AXL F BK ETH NET2 | Firmware vers:all/* |
| 2701949 | AXL F BK ETH XC (HW < 05) | Firmware <1.30 |
| 2701815 | AXL F BK PN | Firmware vers:all/* |
| 2403869 | AXL F BK PN TPS (HW < 02) | Firmware <1.30 |
| 1068857 | AXL F BK PN TPS XC (HW < 01) | Firmware <1.30 |
| 2701222 | AXL F BK PN XC | Firmware vers:all/* |
| 2701686 | AXL F BK S3 (HW < 05) | Firmware <1.40 |
| 2701457 | AXL F BK SAS | Firmware vers:all/* |
| 2897758 | IL EIP BK DI8 DO4 2TX-PAC | Firmware vers:all/* |
| 2703981 | IL ETH BK DI8 DO4 2TX-PAC | Firmware vers:all/* |
| 2701388 | IL ETH BK DI8 DO4 2TX-XC-PAC | Firmware vers:all/* |
| 2878379 | IL PN BK DI8 DO4 2SCRJ-PAC | Firmware vers:all/* |
| 2703994 | IL PN BK DI8 DO4 2TX-PAC | Firmware vers:all/* |
| 2403696 | IL PN BK-PAC | Firmware vers:all/* |
| 2692380 | IL S3 BK DI8 DO4 2TX-PAC | Firmware vers:all/* |
Vulnerabilities
Expand / Collapse allIn certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists.
Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:
Measures to protect network-capable devices with Ethernet connection dam-mdc.phoenixcontact.com/asset/1564...
Remediation
For the following devices, a firmware update is available that disables the above-mentioned undocumented FTP access. PHOENIX CONTACT recommends upgrading these devices to the latest firmware.
| Article No | Article | Fixed Version | FW Download |
|---|---|---|---|
| 1068857 | AXL F BK PN TPS XC | FW >1.30, HW 01 | [www.phoenixcontact.net/qr/1068857/fir... |
| 2403869 | AXL F BK PN TPS | FW >1.30, HW 02 | [www.phoenixcontact.net/qr/2403869/fir... |
| 2688394 | AXL F BK EIP | FW >1.30, HW 05 | [www.phoenixcontact.net/qr/2688394/fir... |
| 2702782 | AXL F BK EIP EF | FW >1.30, HW 01 | [www.phoenixcontact.net/qr/2702782/fir... |
| 2688459 | AXL F BK ETH | FW >1.30, HW 05 | [www.phoenixcontact.net/qr/2688459/fir... |
| 2701949 | AXL F BK ETH XC | FW >1.30, HW 05 | [www.phoenixcontact.net/qr/2701949/fir... |
| 2701686 | AXL F BK S3 | FW >1.40, HW 05 | [www.phoenixcontact.net/qr/2701686/fir... |
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 23.06.2021 14:15 | Initial revision. |
| 2 | 14.05.2025 14:28 | Fix: version space, added distribution |