Vulnerability Description
All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when handling very large cookies (a different vulnerability than CVE-2018-10728).
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phoenixcontact | Fl Switch 3005 Firmware | <= 1.33 |
| Phoenixcontact | Fl Switch 3005 | - |
| Phoenixcontact | Fl Switch 3005T Firmware | >= 1.0, <= 1.33 |
| Phoenixcontact | Fl Switch 3005T | - |
| Phoenixcontact | Fl Switch 3004T-Fx Firmware | >= 1.0, <= 1.33 |
| Phoenixcontact | Fl Switch 3004T-Fx | - |
| Phoenixcontact | Fl Switch 3004T-Fx St Firmware | >= 1.0, <= 1.33 |
| Phoenixcontact | Fl Switch 3004T-Fx St | - |
| Phoenixcontact | Fl Switch 3008 Firmware | >= 1.0, <= 1.33 |
| Phoenixcontact | Fl Switch 3008 | - |
| Phoenixcontact | Fl Switch 3008T Firmware | >= 1.0, <= 1.33 |
| Phoenixcontact | Fl Switch 3008T | - |
| Phoenixcontact | Fl Switch 3006T-2Fx Firmware | >= 1.0, <= 1.33 |
| Phoenixcontact | Fl Switch 3006T-2Fx | - |
| Phoenixcontact | Fl Switch 3006T-2Fx St Firmware | >= 1.0, <= 1.33 |
| Phoenixcontact | Fl Switch 3006T-2Fx St | - |
| Phoenixcontact | Fl Switch 3012E-2Sfx Firmware | >= 1.0, <= 1.33 |
| Phoenixcontact | Fl Switch 3012E-2Sfx | - |
| Phoenixcontact | Fl Switch 3016E Firmware | >= 1.0, <= 1.33 |
| Phoenixcontact | Fl Switch 3016E | - |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/104231Third Party AdvisoryVDB Entry
- https://cert.vde.com/de-de/advisories/vde-2018-007PatchThird Party Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02PatchThird Party AdvisoryUS Government Resource
- http://www.securityfocus.com/bid/104231Third Party AdvisoryVDB Entry
- https://cert.vde.com/de-de/advisories/vde-2018-007PatchThird Party Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02PatchThird Party AdvisoryUS Government Resource
FAQ
What is CVE-2018-10731?
CVE-2018-10731 is a vulnerability with a CVSS score of 9.0 (CRITICAL). All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when handling very large cookies (a different vulnerability than CVE-...
How severe is CVE-2018-10731?
CVE-2018-10731 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-10731?
Check the references section above for vendor advisories and patch information. Affected products include: Phoenixcontact Fl Switch 3005 Firmware, Phoenixcontact Fl Switch 3005, Phoenixcontact Fl Switch 3005T Firmware, Phoenixcontact Fl Switch 3005T, Phoenixcontact Fl Switch 3004T-Fx Firmware.