CVE-2018-13990

Published: May 6, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 is vulnerable to brute-force attacks, because of Improper Restriction of Excessive Authentication Attempts.

Affected (29)

Products: Phoenixcontact: Fl Switch 3005 Firmware, Fl Switch 3005t Firmware, Fl Switch 3004t Fx Firmware, Fl Switch 3004t Fx St Firmware, Fl Switch 3008 Firmware, Fl Switch 3008t Firmware, Fl Switch 3006t 2fx Firmware, Fl Switch 3006t 2fx St Firmware, Fl Switch 3012e 2sfx Firmware, Fl Switch 3016e Firmware, Fl Switch 3016 Firmware, Fl Switch 3016t Firmware, Fl Switch 3006t 2fx Sm Firmware, Fl Switch 4008t 2sfp Firmware, Fl Switch 4008t 2gt 4fx Sm Firmware, Fl Switch 4008t 2gt 3fx Sm Firmware, Fl Switch 4808e 16fx Lc 4gc Firmware, Fl Switch 4808e 16fx Sm 4gc Firmware, Fl Switch 4808e 16fx Sm St 4gc Firmware, Fl Switch 4808e 16fx St 4gc Firmware, Fl Switch 4808e 16fx 4gc Firmware, Fl Switch 4808e 16fx Sm Lc 4gc Firmware, Fl Switch 4012t 2gt 2fx Firmware, Fl Switch 4012t 2gt 2fx St Firmware, Fl Switch 4824e 4gc Firmware, Fl Switch 4800e 24fx 4gc Firmware, Fl Switch 4800e 24fx Sm 4gc Firmware, Fl Switch 3012e 2fx Sm Firmware, Fl Switch 4000t 8poe 2sfp R Firmware

29 products

Fl Switch 3005 Firmware

Fl Switch 3005t Firmware

Fl Switch 3004t Fx Firmware

Fl Switch 3004t Fx St Firmware

Fl Switch 3008 Firmware

Fl Switch 3008t Firmware

Fl Switch 3006t 2fx Firmware

Fl Switch 3006t 2fx St Firmware

Fl Switch 3012e 2sfx Firmware

Fl Switch 3016e Firmware

Fl Switch 3016 Firmware

Fl Switch 3016t Firmware

Fl Switch 3006t 2fx Sm Firmware

Fl Switch 4008t 2sfp Firmware

Fl Switch 4008t 2gt 4fx Sm Firmware

Fl Switch 4008t 2gt 3fx Sm Firmware

Fl Switch 4808e 16fx Lc 4gc Firmware

Fl Switch 4808e 16fx Sm 4gc Firmware

Fl Switch 4808e 16fx Sm St 4gc Firmware

Fl Switch 4808e 16fx St 4gc Firmware

Fl Switch 4808e 16fx 4gc Firmware

Fl Switch 4808e 16fx Sm Lc 4gc Firmware

Fl Switch 4012t 2gt 2fx Firmware

Fl Switch 4012t 2gt 2fx St Firmware

Fl Switch 4824e 4gc Firmware

Fl Switch 4800e 24fx 4gc Firmware

Fl Switch 4800e 24fx Sm 4gc Firmware

Fl Switch 3012e 2fx Sm Firmware

Fl Switch 4000t 8poe 2sfp R Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3005 Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3005	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3005t Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3005t	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3004t Fx Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3004t Fx	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3004t Fx St Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3004t Fx St	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3008 Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3008	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3008t Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3008t	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3006t 2fx Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3006t 2fx	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3006t 2fx St Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3006t 2fx St	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3012e 2sfx Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3012e 2sfx	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3016e Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3016e	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3016 Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3016	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3016t Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3016t	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3006t 2fx Sm Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3006t 2fx Sm	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4008t 2sfp Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4008t 2sfp	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4008t 2gt 4fx Sm Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4008t 2gt 4fx Sm	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4008t 2gt 3fx Sm Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4008t 2gt 3fx Sm	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4808e 16fx Lc 4gc Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4808e 16fx Lc 4gc	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4808e 16fx Sm 4gc Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4808e 16fx Sm 4gc	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4808e 16fx Sm St 4gc Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4808e 16fx Sm St 4gc	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4808e 16fx St 4gc Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4808e 16fx St 4gc	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4808e 16fx 4gc Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4808e 16fx 4gc	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4808e 16fx Sm Lc 4gc Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4808e 16fx Sm Lc 4gc	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4012t 2gt 2fx Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4012t 2gt 2fx	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4012t 2gt 2fx St Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4012t 2gt 2fx St	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4824e 4gc Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4824e 4gc	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4800e 24fx 4gc Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4800e 24fx 4gc	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4800e 24fx Sm 4gc Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4800e 24fx Sm 4gc	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 3012e 2fx Sm Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 3012e 2fx Sm	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Fl Switch 4000t 8poe 2sfp R Firmware	Before 1.35

Running on/with	Platform Versions
Phoenixcontact Fl Switch 4000t 8poe 2sfp R	All versions

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

http://www.securityfocus.com/bid/106737

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-19-024-02

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/106737

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-19-024-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.