CVE-2017-16723

Published: Dec 11, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422/485, FL COMSERVER BAS 232/422/485-T, FL COMSERVER UNI 232/422/485-T, FL COM SERVER RS232, FL COM SERVER RS485, and PSI-MODEM/ETH (running firmware versions prior to 1.99, 2.20, or 2.40). The cross-site scripting vulnerability has been identified, which may allow remote code execution.

Affected (13)

Products: Phoenixcontact: Fl Comserver Basic 232 Firmware, Fl Comserver Uni 422 Firmware, Fl Comserver Bas 485 T Firmware, Fl Com Server Rs232 Firmware, Fl Com Server Rs485 Firmware, Psi Modem/eth Firmware, Fl Comserver Basic 422 Firmware, Fl Comserver Basic 485 Firmware, Fl Comserver Uni 485 T Firmware, Fl Comserver Uni 485 Firmware, Fl Comserver Uni 232 Firmware, Fl Comserver Bas 422 Firmware, Fl Comserver Bas 232 Firmware

Phoenixcontact

13 products

Fl Comserver Basic 232 Firmware

Fl Comserver Uni 422 Firmware

Fl Comserver Bas 485 T Firmware

Fl Com Server Rs232 Firmware

Fl Com Server Rs485 Firmware

Psi Modem/eth Firmware

Fl Comserver Basic 422 Firmware

Fl Comserver Basic 485 Firmware

Fl Comserver Uni 485 T Firmware

Fl Comserver Uni 485 Firmware

Fl Comserver Uni 232 Firmware

Fl Comserver Bas 422 Firmware

Fl Comserver Bas 232 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Comserver Basic 232 Firmware	Version 2.40

Running on/with	Platform Versions
Phoenixcontact Fl Comserver Basic 232	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Comserver Uni 422 Firmware	Version 2.40

Running on/with	Platform Versions
Phoenixcontact Fl Comserver Uni 422	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Comserver Bas 485 T Firmware	Version 2.40

Running on/with	Platform Versions
Phoenixcontact Fl Comserver Bas 485 T	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Com Server Rs232 Firmware	Version 1.99

Running on/with	Platform Versions
Phoenixcontact Fl Com Server Rs232	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Com Server Rs485 Firmware	Version 1.99

Running on/with	Platform Versions
Phoenixcontact Fl Com Server Rs485	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Psi Modem/eth Firmware	Version 2.20

Running on/with	Platform Versions
Phoenixcontact Psi Modem/eth	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Comserver Basic 422 Firmware	Version 2.40

Running on/with	Platform Versions
Phoenixcontact Fl Comserver Basic 422	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Comserver Basic 485 Firmware	Version 2.40

Running on/with	Platform Versions
Phoenixcontact Fl Comserver Basic 485	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Comserver Uni 485 T Firmware	Version 2.40

Running on/with	Platform Versions
Phoenixcontact Fl Comserver Uni 485 T	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Comserver Uni 485 Firmware	Version 2.40

Running on/with	Platform Versions
Phoenixcontact Fl Comserver Uni 485	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Comserver Uni 232 Firmware	Version 2.40

Running on/with	Platform Versions
Phoenixcontact Fl Comserver Uni 232	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Comserver Bas 422 Firmware	Version 2.40

Running on/with	Platform Versions
Phoenixcontact Fl Comserver Bas 422	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Comserver Bas 232 Firmware	Version 2.40

Running on/with	Platform Versions
Phoenixcontact Fl Comserver Bas 232	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

http://www.securityfocus.com/bid/102111

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryVDB Entry

https://cert.vde.com/de-de/advisories/vde-2017-004

Source: ics-cert@hq.dhs.gov

Issue TrackingThird Party Advisory

https://ics-cert.us-cert.gov/advisories/ICSA-17-341-03

Source: ics-cert@hq.dhs.gov

Issue TrackingMitigationThird Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/102111

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://cert.vde.com/de-de/advisories/vde-2017-004

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://ics-cert.us-cert.gov/advisories/ICSA-17-341-03

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingMitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.