The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is vulnerable to a denial-of-service attack by making more than

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• phoenixcontact fl switch 3004t-fx firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3004t-fx st firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3005 firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3005t firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3006t-2fx firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3006t-2fx sm firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3006t-2fx st firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3008 firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3008t firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3012e-2fx sm firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3012e-2sfx firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3016 firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3016e firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 3016t firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 4000t-8poe-2sfp-r firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 4008t-2gt-3fx sm firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 4008t-2gt-4fx sm firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 4008t-2sfp firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 4012t 2gt 2fx firmware1.0 and later · up to 1.34 inclusive
• phoenixcontact fl switch 4012t-2gt-2fx st firmware1.0 and later · up to 1.34 inclusive

Other highest-scoring records for the same primary product.

• CVE-2018-13990The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 is vulnerable to brute-force attacks, because of Improper Res
  40Plan
• CVE-2017-16743An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1
  40Plan
• CVE-2018-13992The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by
  39Monitor
• CVE-2018-10731All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when hand
  37Monitor
• CVE-2018-10730All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection.
  37Monitor
• CVE-2018-13993The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is prone to CSRF.
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.