Out-of-bounds Read in Phoenix Contact Charx Sec-3000
CVE-2024-26000
An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.
Vulnerability class: Buffer Overflow
EPSS: 0.008 (52.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Phoenix Contact Charx Sec-3000 — versions 0
- Phoenix Contact Charx Sec-3050 — versions 0
- Phoenix Contact Charx Sec-3100 — versions 0
- Phoenix Contact Charx Sec-3150 — versions 0
- Phoenixcontact Charx_sec-3000
- Phoenixcontact Charx_sec-3000_firmware
- Phoenixcontact Charx_sec-3050
- Phoenixcontact Charx_sec-3050_firmware
- Phoenixcontact Charx_sec-3100
- Phoenixcontact Charx_sec-3100_firmware
Weakness classification (CWE)
References
- info@cert.vde.com (Third Party Advisory)
Frequently asked questions
- What is CVE-2024-26000?
- CVE-2024-26000 is a medium-severity vulnerability in Phoenix Contact Charx Sec-3000, classified under Out-of-bounds Read. CVSS score: 5.9/10. Published 2024-03-12.
- How severe is CVE-2024-26000?
- Medium severity. CVSS v3 base score is 5.9 out of 10.