Share: Email | Twitter

ID

VDE-2020-013

Published

2020-03-27 10:48 (CET)

Last update

2020-03-27 10:48 (CET)

Vendor(s)

PHOENIX CONTACT GmbH & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
PORTICO SERVER 16 CLIENT <= 3.0.7
PORTICO SERVER 1 CLIENT <= 3.0.7
PORTICO SERVER 4 CLIENT <= 3.0.7

Summary

If the software runs as a service, a user with limited access can gain administrator privileges by starting a shell with administrator rights from the Import / Export configuration dialog.

CVE ID

CVE-2020-10940 

Last Update:

April 15, 2020, 10:03 a.m.

Severity

7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) 

Weakness

Improper Privilege Management  (CWE-269) 

Summary

Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.

Details

nvd.nist.gov 

Impact

A malicious user could use this vulnerability to gain administrator privileges on the Computer running the Portico software.

Solution

Phoenix Contact strongly recommends users to upgrade to Portico V3.0.8 or higher which fixes this vulnerability. The current version of Portico is available on the Phoenix Contact website.

Phoenix Contact strongly recommends protection measures against unauthorized access for network-compatible devices, solutions and PC-based software. For detailed information please refer to our application note:

Measures to protect network-compatible devices with communication interfaces, solutions and PC-based software against unauthorized access

Reported by

We kindly appreciate the coordinated disclosure of this vulnerability by the finder.