CVE-2020-12518

Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.

State: Published
Severity: 5.5 Medium
Published: Dec 17, 2020
Updated: Sep 17, 2024
Reserved: Apr 30, 2020

Read the record on cve.org

Description

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	CERTVDE

Weaknesses

CWE-200 Information Exposure

Affected Products

Product	Versions
AXC F 1152 (1151412)Phoenix Contact	before 2021.0 LTSAffected
AXC F 2152 (2404267)Phoenix Contact	before 2021.0 LTSAffected
AXC F 3152 (1069208)Phoenix Contact	before 2021.0 LTSAffected
RFC 4072S (1051328Phoenix Contact	before 2021.0 LTSAffected
AXC F 2152 Starterkit (1046568)Phoenix Contact	before 2021.0 LTSAffected
PLCnext Technology Starterkit (1188165)Phoenix Contact	before 2021.0 LTSAffected

References

https://cert.vde.com/en-us/advisories/vde-2020-049

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.