phoenixcontact config+ 使用未经初始化的指针
CVE编号
CVE-2021-33542利用情况
暂无补丁情况
N/A披露时间
2021-06-26漏洞描述
Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The attacker needs to get access to an original bus configuration file (*.bcp) to be able to manipulate data inside. After manipulation the attacker needs to exchange the original file by the manipulated one on the application programming workstation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| https://cert.vde.com/en-us/advisories/vde-2021-020 | |
| https://www.zerodayinitiative.com/advisories/ZDI-21-782/ |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | phoenixcontact | config+ | * | Up to (including) 1.87 | |||||
| 运行在以下环境 | |||||||||
| 应用 | phoenixcontact | pc_worx | * | Up to (including) 1.87 | |||||
| 运行在以下环境 | |||||||||
| 应用 | phoenixcontact | pc_worx_express | * | Up to (including) 1.87 | |||||
- 攻击路径 本地
- 攻击复杂度 高
- 权限要求 无
- 影响范围 未更改
- 用户交互 需要
- 可用性 高
- 保密性 高
- 完整性 高
| CWE-ID | 漏洞类型 |
| CWE-824 | 使用未经初始化的指针 |
Exp相关链接
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论