CVE-2014-9195

Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function

Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.

Affected

Phoenix Contact · ProConOs · MultiProg

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v2.0 HQ

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

80.69% chance of exploitation in the next 30 days, 100th percentile

Published

2015-01-17

Updated

2025-09-05

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/scada/phoenix_command.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/37066

Security advisories

• https://ics-cert.us-cert.gov/advisories/ICSA-15-013-03

References

• CVE Record
• NVD entry