CVE-2023-3526
CriticalCVSS 9.6Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
In PHOENIX CONTACT's TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10, there is a vulnerability to reflective XSS in the license viewer page. An unauthenticated remote attacker could exploit this vulnerability to execute code in the context of the user's browser.
Risk Assessment
An attacker could take control of the user's session, potentially leading to data leakage or unauthorized access to the system. This poses a serious security threat to the organization.
Recommendation
It is recommended to update the devices to the latest software versions to eliminate this vulnerability. Additionally, implementing security mechanisms against XSS attacks is advisable.
Original NVD description (English source)
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser.