CVE-2015-4051

Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a beckhoff.com:service:cxconfig:1#Write SOAP action to /upnpisapi.

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:C

EPSS

5.74% chance of exploitation in the next 30 days, 93rd percentile

Published

2015-06-08

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://seclists.org/fulldisclosure/2015/Jun/10

Security advisories

• http://ftp.beckhoff.com/download/document/IndustPC/Advisory-2015-001.pdf
• http://www.securityfocus.com/bid/75042

References

• CVE Record
• NVD entry