Horizon Alert
Summary of the vulnerability and why it matters
Certain Phoenix Contact devices are susceptible to unauthorized access. This vulnerability allows remote attackers to establish connections and potentially access or modify sensitive information. The impact can include unauthorized data exposure and system alterations.
- Vulnerable Phoenix Contact devices
- Flaw permits unauthorized access
- Potential for data theft or changes
Attack Path
How an attacker could exploit the issue
Multiple Phoenix Contact devices are susceptible to remote attacks due to an exposure in their TCP port 1962. Attackers can establish unauthenticated TCP sessions to this port to gain unauthorized access to sensitive information or modify system configurations. This can be achieved by leveraging features like the 'Create Backup' function to navigate through directories and potentially exfiltrate or alter critical data.
- Exposure condition: Network access to TCP port 1962.
- Attacker starting point: Unauthenticated network access.
- Trigger and result: Using backup feature to access directories.
Live Threat
Current exploitation, exposure, and threat context
The identified vulnerability permits unauthorized remote access to sensitive information and system modifications on specific industrial control devices. Attackers can exploit this by establishing TCP sessions, potentially disrupting operations or compromising data integrity. Due to the nature of the affected devices and their typical deployment in industrial environments, the direct risk to organizations is considered unlikely.
- Likely attacker skill level: Low
- Required access or conditions: Network access to device
- Business risk or urgency: Unlikely impact
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts multiple Phoenix Contact devices, allowing unauthorized external access to establish TCP sessions. Attackers can leverage this to obtain sensitive information or make unauthorized changes, including using the backup feature to access all directories. The potential for unauthorized information disclosure and system modification presents a significant business risk.
- Identify exposed devices.
- Isolate affected systems.
- Apply vendor fixes and validate.
- Monitor for related activity.
