Phoenix Contact FL SWITCH Products Stack-Based Buffer Overflow Vulnerability in TFTP Command Handling Allowing Denial-of-Service

A stack-based buffer overflow vulnerability has been identified in the TFTP file-transfer command handling of Phoenix Contact FL SWITCH 2xxx, FL SWITCH TSN 23xx, and FL SWITCH 59xx firmware prior to version 3.53. This vulnerability allows a low-privileged attacker with Telnet or SSH access to cause memory corruption by providing unexpected or oversized filename inputs. Exploitation of this vulnerability leads to internal buffer corruption, causing the command-line interface and web dashboard to become unavailable, thereby creating a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, making the command-line interface and web dashboard unavailable.

Remediation

Users are advised to update to the latest firmware version 3.53, which addresses this vulnerability.