← CVE Intelligence

CVE-2020-12517

Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation). PUBLISHED

Description (CNA)

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).

Affected (CNA)

Vendor / productVersions
Phoenix Contact / AXC F 1152 (1151412)affected unspecified before 2021.0 LTS
Phoenix Contact / AXC F 2152 (2404267)affected unspecified before 2021.0 LTS
Phoenix Contact / AXC F 3152 (1069208)affected unspecified before 2021.0 LTS
Phoenix Contact / RFC 4072S (1051328affected unspecified before 2021.0 LTS
Phoenix Contact / AXC F 2152 Starterkit (1046568)affected unspecified before 2021.0 LTS
Phoenix Contact / PLCnext Technology Starterkit (1188165)affected unspecified before 2021.0 LTS

CWE

CWE-79

References

ADP enrichment

CVE

No English description supplied.