Vulnerability Description
PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices contain a hardcoded certificate (and key) that is used by default for web-based services on the device. Impersonation, man-in-the-middle, or passive decryption attacks are possible if the generic certificate is not replaced by a device-specific certificate during installation.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phoenixcontact | Tc Router 3002T-4G Firmware | <= 2.05.3 |
| Phoenixcontact | Tc Router 3002T-4G | - |
| Phoenixcontact | Tc Router 2002T-3G Firmware | <= 2.05.3 |
| Phoenixcontact | Tc Router 2002T-3G | - |
| Phoenixcontact | Tc Router 3002T-4G Vzw Firmware | <= 2.05.3 |
| Phoenixcontact | Tc Router 3002T-4G Vzw | - |
| Phoenixcontact | Tc Router 3002T-4G Att Firmware | <= 2.05.3 |
| Phoenixcontact | Tc Router 3002T-4G Att | - |
| Phoenixcontact | Tc Cloud Client 1002-4G Firmware | <= 2.03.17 |
| Phoenixcontact | Tc Cloud Client 1002-4G | - |
| Phoenixcontact | Tc Cloud Client 1002-Txtx Firmware | <= 1.03.17 |
| Phoenixcontact | Tc Cloud Client 1002-Txtx | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/156729/Phoenix-Contact-TC-Router-TC-Cloud-CExploitThird Party Advisory
- http://seclists.org/fulldisclosure/2020/Mar/15ExploitThird Party Advisory
- https://cert.vde.com/en-us/advisories/Third Party Advisory
- https://cert.vde.com/en-us/advisories/vde-2020-003Third Party Advisory
- http://packetstormsecurity.com/files/156729/Phoenix-Contact-TC-Router-TC-Cloud-CExploitThird Party Advisory
- http://seclists.org/fulldisclosure/2020/Mar/15ExploitThird Party Advisory
- https://cert.vde.com/en-us/advisories/Third Party Advisory
- https://cert.vde.com/en-us/advisories/vde-2020-003Third Party Advisory
FAQ
What is CVE-2020-9435?
CVE-2020-9435 is a vulnerability with a CVSS score of 7.5 (HIGH). PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03...
How severe is CVE-2020-9435?
CVE-2020-9435 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-9435?
Check the references section above for vendor advisories and patch information. Affected products include: Phoenixcontact Tc Router 3002T-4G Firmware, Phoenixcontact Tc Router 3002T-4G, Phoenixcontact Tc Router 2002T-3G Firmware, Phoenixcontact Tc Router 2002T-3G, Phoenixcontact Tc Router 3002T-4G Vzw Firmware.