CVE-2020-9436

PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices allow authenticated users to inject system commands through a modified POST request to a specific URL.

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

2.61% chance of exploitation in the next 30 days, 85th percentile

Published

2020-03-12

Updated

2024-08-04

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/156729/Phoenix-Contact-TC-Router-TC-Cloud-Client-Com…
• http://seclists.org/fulldisclosure/2020/Mar/15

Security advisories

• https://cert.vde.com/en-us/advisories
• https://cert.vde.com/en-us/advisories/vde-2020-003

References

• CVE Record
• NVD entry