CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
84.9%
**ATTENTION:**Remotely exploitable/low skill level to exploit.
Vendor: PHOENIX CONTACT
Equipment: FL COMSERVER, FL COM SERVER, and PSI-MODEM/ETH
Vulnerability: Cross-site Scripting
The following models running firmware versions prior to 1.99, 2.20, or 2.40 of FL COMSERVER, FL COM SERVER, and PSI-MODEM/ETH, industrial networking equipment, are affected:
Successful exploitation of this vulnerability may allow a remote attacker to change configuration variables on the device.
PHOENIX CONTACT has released new firmware versions for the affected devices. The latest download links can be found at:
<https://cert.vde.com/de-de/advisories/vde-2017-004>
NCCIC/ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available in the ICSβCERT Technical Information Paper, ICS-TIP-12-146-01BβTargeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.
No known public exploits specifically target this vulnerability.
The cross-site scripting vulnerability has been identified, which may allow remote code execution.
CVE-2017-16723 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H).
Maxim Rupp reported the vulnerability to ICS-CERT. CERT@VDE coordinated the disclosure with Mr. Rupp and ICS-CERT.
Critical Infrastructure Sectors: Communications, Critical Manufacturing, Information Technology
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16723
cert.vde.com/de-de/advisories/vde-2017-004
cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?product=https://www.cisa.gov/news-events/ics-advisories/icsa-17-341-03
cwe.mitre.org/data/definitions/79.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=PHOENIX%20CONTACT%20FL%20COMSERVER%2C%20FL%20COM%20SERVER%2C%20and%20PSI-MODEM/ETH+https://www.cisa.gov/news-events/ics-advisories/icsa-17-341-03
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-17-341-03&title=PHOENIX%20CONTACT%20FL%20COMSERVER%2C%20FL%20COM%20SERVER%2C%20and%20PSI-MODEM/ETH
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-17-341-03
www.oig.dhs.gov/
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=PHOENIX%20CONTACT%20FL%20COMSERVER%2C%20FL%20COM%20SERVER%2C%20and%20PSI-MODEM/ETH&body=www.cisa.gov/news-events/ics-advisories/icsa-17-341-03
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
84.9%