CVE-2020-12517

Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).

State: Published
Severity: 8.8 High
Published: Dec 17, 2020
Updated: Sep 16, 2024
Reserved: Apr 30, 2020

Read the record on cve.org

Description

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
AXC F 1152 (1151412)Phoenix Contact	before 2021.0 LTSAffected
AXC F 2152 (2404267)Phoenix Contact	before 2021.0 LTSAffected
AXC F 3152 (1069208)Phoenix Contact	before 2021.0 LTSAffected
RFC 4072S (1051328Phoenix Contact	before 2021.0 LTSAffected
AXC F 2152 Starterkit (1046568)Phoenix Contact	before 2021.0 LTSAffected
PLCnext Technology Starterkit (1188165)Phoenix Contact	before 2021.0 LTSAffected

References

https://cert.vde.com/en-us/advisories/vde-2020-049

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.