[vc_row][vc_column][vc_column_text]
| Overview : | ||||||||||
|
||||||||||
PHOENIX CONTACT Local Privilege Escalation in Portico Remote desktop control software
VDE-2020-013 (2020-03-27 10:48 UTC+0100)
CVE Identifier
Affected Vendors
PHOENIX CONTACT
Affected Products
| Product | Article Number | Affected Versions |
| PORTICO SERVER 1 CLIENT | 2701453 | <= 3.0.7 |
| PORTICO SERVER 4 CLIENT | 2701455 | <= 3.0.7 |
| PORTICO SERVER 16 CLIENT | 2701456 | <= 3.0.7 |
Vulnerability Type
Incorrect Execution-Assigned Permissions (CWE-279)
Summary
If the software runs as a service, a user with limited access can gain administrator privileges by starting a shell with administrator rights from the Import / Export configuration dialog.
Impact
A malicious user could use this vulnerability to gain administrator privileges on the Computer running the Portico software.
Solution
Phoenix Contact strongly recommends users to upgrade to Portico V3.0.8 or higher which fixes this vulnerability. The current version of Portico is available on the Phoenix Contact website at following address: www.phoenixcontact.net/qr/2701453/softw
Phoenix Contact strongly recommends protection measures against unauthorized access for network-compatible devices, solutions and PC-based software. For detailed information please refer to our application note:
Reported by
We kindly appreciate the coordinated disclosure of this vulnerability by the finder.
[/vc_column_text][/vc_column][/vc_row]
