An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing the attacker to obtain administrative privileges on the device.

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-16743
• https://cert.vde.com/en-us/advisories/vde-2017-006
• https://ics-cert.us-cert.gov/advisories/ICSA-18-011-03