Summary
A Directory Traversal Vulnerability enables arbitrary file access in ENERGY AXC PU Web service.An authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service.
Impact
The vulnerability enables an attacker to gain access to the file system of the devices. This can enable the attacker to compromise the device in terms of availability, integrity and confidentiality.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| 1264327 | ENERGY AXC PU | Firmware <V04.15.00.00 |
| 1169323 | Infobox* | Firmware <=V02.02.00.00 |
| 1264328 | SMARTRTU AXC IG | Firmware <=V01.02.00.01 |
| 1110435 | SMARTRTU AXC SG | Firmware <=V01.08.00.02 |
Vulnerabilities
Expand / Collapse allIn Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service.
Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to Phoenix Contacts application note.Measures to protect network-capable devices with Ethernet connection
Remediation
Phoenix Contact strongly recommends updating to the latest firmware mentioned in the list of affected products, which fixes this vulnerability.
| Article no | Article | Fixed version |
|---|---|---|
| 1264327 | ENERGY AXC PU | V04.15.00.01 |
| 1110435 | SMARTRTU AXC SG | V01.09.00.00 |
| 1264328 | SMARTRTU AXC IG | End of Q3 2023 |
As Infobox (1169323) is discontinued, no update will be available.
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 11.04.2023 10:00 | Initial revision. |