CVE-2024-26000

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26000
An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cert.vde.com/en/advisories/VDE-2024-011 Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2024-011 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3050:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3100:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:phoenixcontact:charx_sec-3150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3150:-:*:*:*:*:*:*:*
History

24 Jan 2025, 07:15

Type Values Removed Values Added
Summary An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.  An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.

23 Jan 2025, 18:47

Type Values Removed Values Added
CPE cpe:2.3:h:phoenixcontact:charx_sec-3000:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3100:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3150:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:charx_sec-3050:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:charx_sec-3100_firmware:*:*:*:*:*:*:*:*
CWE CWE-20 CWE-125
CVSS v2 : unknown
v3 : 5.9 		v2 : unknown
v3 : 7.5
References () https://cert.vde.com/en/advisories/VDE-2024-011 - () https://cert.vde.com/en/advisories/VDE-2024-011 - Third Party Advisory
First Time Phoenixcontact charx Sec-3100 Firmware
Phoenixcontact charx Sec-3050 Firmware
Phoenixcontact charx Sec-3100
Phoenixcontact charx Sec-3000 Firmware
Phoenixcontact charx Sec-3050
Phoenixcontact charx Sec-3150 Firmware
Phoenixcontact charx Sec-3000
Phoenixcontact
Phoenixcontact charx Sec-3150

12 Mar 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-12 09:15

Updated : 2025-01-24 07:15

NVD link : CVE-2024-26000

Mitre link : CVE-2024-26000

JSON object : View

Products Affected

phoenixcontact

  • charx_sec-3000
  • charx_sec-3050_firmware
  • charx_sec-3150
  • charx_sec-3150_firmware
  • charx_sec-3100
  • charx_sec-3050
  • charx_sec-3000_firmware
  • charx_sec-3100_firmware
CWE
CWE-125

Out-of-bounds Read