CVE-2014-9195

high · 10

Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.

CVSS

80.7%

EPSS (exploit prob.)

100th

EPSS percentile

2015-01-17

Published

AV:N/AC:L/Au:N/C:C/I:C/A:C

Weaknesses

CWE-306CWE-255

Affected products

Vendor	Product	Affected versions
phoenixcontact-software	multiprog	5.0
phoenixcontact-software	multiprog	5.0
phoenixcontact-software	multiprog	5.0
phoenixcontact-software	proconos_eclr	all versions
phoenixcontact-software	proconos_eclr	all versions
phoenixcontact-software	proconos_eclr	all versions
phoenixcontact-software	proconos_eclr	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-03
https://www.exploit-db.com/exploits/37066/
https://ics-cert.us-cert.gov/advisories/ICSA-15-013-03
https://www.exploit-db.com/exploits/37066/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-9195