{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "tracking": { "generator": { "date": "2025-03-26T12:48:11.294Z", "engine": { "version": "2.5.21", "name": "Secvisogram" } }, "id": "VDE-2022-018", "version": "1", "status": "final", "aliases": [ "VDE-2022-018" ], "revision_history": [ { "number": "1", "summary": "initial revision", "date": "2022-05-11T14:20:00.000Z" } ], "current_release_date": "2022-05-11T14:20:00.000Z", "initial_release_date": "2022-05-11T14:20:00.000Z" }, "lang": "en-GB", "title": "PHOENIX CONTACT: Multiple vulnerabilities in RAD-ISM-900-EN-BD devices", "acknowledgments": [ { "organization": "CERTVDE", "urls": [ "https://certvde.com" ], "summary": "coordination" }, { "organization": "DRAGOS", "summary": "reporting", "names": [ "Logan Carpenter" ], "urls": [ "https://www.dragos.com" ] } ], "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "notes": [ { "category": "summary", "title": "Summary", "text": "Multiple vulnerabilities have been discovered in the firmware and in libraries utilized of RAD-ISM-900-EN-BD devices:\n\nIn addition to the above listed CVEs the following issues were identified:\n\nVulnerabilities related to outdated libraries:\n\nBusyBox version 0.60.1: A CVE scan revealed 13 potential vulnerabilities. Some of these vulnerabilities impact services used by this device such as NTP and DHCP.\nOpenSSL version 0.9.7-beta3: This version of OpenSSL uses deprecated ciphers and a CVE scan revealed over 87 potential vulnerabilities.\nOver-privileged web application:\nThe web application is operated with root privileges. Therefore, if an attacker were able to achieve RCE via the web application they would be executing with the highest level of privileges." }, { "category": "description", "title": "Impact", "text": "The abovementioned vulnerabilities allow an attacker to execute arbitrary shell commands and/or upload arbitrary files to the device with root privileges.\n\nSome software libraries compiled into the device firmware are outdated and contain known vulnerabilities. Some of those vulnerabilities may be exploitable in the device context whilst others may not have any effect as the specific vulnerable function is not used. These vulnerabilities have not been investigated in detail." }, { "category": "description", "title": "Mitigation", "text": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf" }, { "category": "description", "title": "Remediation", "text": "The family of RAD-ISM-900-EN-BD devices is end of life and will not receive updates anymore. If operation within a secured environment cannot be ensured in the specific customer application, please contact your local PHOENIX CONTACT support to discuss alternative solutions." } ], "publisher": { "category": "vendor", "name": "Phoenix Contact GmbH & Co. KG", "namespace": "https://phoenixcontact.com/psirt", "contact_details": "psirt@phoenixcontact.com" }, "references": [ { "summary": "CERT@VDE Security Advisories for PHOENIX CONTACT", "url": "https://certvde.com/en/advisories/vendor/phoenixcontact/", "category": "external" }, { "summary": "VDE-2022-018: PHOENIX CONTACT: Multiple vulnerabilities in RAD-ISM-900-EN-BD devices - HTML", "url": "https://certvde.com/de/advisories/VDE-2020-013/", "category": "self" }, { "summary": "VDE-2022-018: PHOENIX CONTACT: Multiple vulnerabilities in RAD-ISM-900-EN-BD devices - CSAF", "category": "self", "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-018.json" } ] }, "product_tree": { "branches": [ { "category": "vendor", "name": "Phoenix Contact", "branches": [ { "category": "product_family", "name": "Hardware", "branches": [ { "category": "product_name", "name": "RAD-ISM-900-EN-BD", "product": { "name": "RAD-ISM-900-EN-BD", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "2900016" ] } } }, { "category": "product_name", "name": "RAD-ISM-900-EN-BD-BUS", "product": { "name": "RAD-ISM-900-EN-BD-BUS", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "2900017" ] } } }, { "category": "product_name", "name": "RAD-ISM-900-EN-BD/B", "product": { "name": "RAD-ISM-900-EN-BD/B", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "2901205" ] } } } ] }, { "category": "product_family", "name": "Firmware", "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Firmware vers:all/*", "product_id": "CSAFPID-21001" } } ] } ] } ], "relationships": [ { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware vers:all/* installed on RAD-ISM-900-EN-BD", "product_id": "CSAFPID-31001" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware vers:all/* installed on RAD-ISM-900-EN-BD-BUS", "product_id": "CSAFPID-31002" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware vers:all/* installed on RAD-ISM-900-EN-BD/B", "product_id": "CSAFPID-31003" } } ], "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "affected products", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ] }, "vulnerabilities": [ { "cve": "CVE-2022-29897", "title": "CVE-2022-29897", "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "scores": [ { "cvss_v3": { "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "notes": [ { "category": "summary", "text": "On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware." } ], "remediations": [ { "category": "mitigation", "details": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "The family of RAD-ISM-900-EN-BD devices is end of life and will not receive updates anymore. If operation within a secured environment cannot be ensured in the specific customer application, please contact your local PHOENIX CONTACT support to discuss alternative solutions.", "group_ids": [ "CSAFGID-0001" ] } ], "cwe": { "id": "CWE-20", "name": "Improper Input Validation" } }, { "cve": "CVE-2022-29898", "title": "CVE-2022-29898", "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "scores": [ { "cvss_v3": { "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "notes": [ { "category": "summary", "text": "On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware." } ], "remediations": [ { "category": "mitigation", "details": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "The family of RAD-ISM-900-EN-BD devices is end of life and will not receive updates anymore. If operation within a secured environment cannot be ensured in the specific customer application, please contact your local PHOENIX CONTACT support to discuss alternative solutions.", "group_ids": [ "CSAFGID-0001" ] } ], "cwe": { "id": "CWE-354", "name": "Improper Validation of Integrity Check Value" } } ] }