Phoenix Contact FL SWITCH Products Stack-Based Buffer Overflow Vulnerability in Telnet/SSH CLI Login

A stack-based buffer overflow vulnerability has been identified in the Telnet/SSH command-line interface login process of certain Phoenix Contact FL SWITCH models. This vulnerability affects firmware versions prior to 3.53. When an unauthenticated attacker sends an oversized or unexpected username, it triggers an overflow that crashes the thread managing the login attempt, abruptly closing the session. However, this disruption only impacts the affected session, leaving other command-line interface sessions intact, which limits the overall severity of the availability issue.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the affected session to crash and close, while other sessions remain unaffected.

Remediation

Users are advised to update to the latest firmware version 3.53, which addresses this vulnerability.