CVE-2020-10940 : Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3

Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.

Published 2020-03-27 21:15:11

Updated 2020-03-31 19:07:37

Source MITRE

View at NVD, CVE.org

Vulnerability category: Gain privilege

Products affected by CVE-2020-10940

Phoenixcontact » Portico Server 16 Client
Versions up to, including, (<=) 3.0.7
cpe:2.3:a:phoenixcontact:portico_server_16_client:*:*:*:*:*:*:*:*
Matching versions
Phoenixcontact » Portico Server 1 Client
Versions up to, including, (<=) 3.0.7
cpe:2.3:a:phoenixcontact:portico_server_1_client:*:*:*:*:*:*:*:*
Matching versions
Phoenixcontact » Portico Server 4 Client
Versions up to, including, (<=) 3.0.7
cpe:2.3:a:phoenixcontact:portico_server_4_client:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Assigned by: nvd@nist.gov (Primary)

https://cert.vde.com/en-us/advisories/vde-2020-013

PHOENIX CONTACT Local Privilege Escalation in Portico Remote desktop control software — English (USA)
Third Party Advisory

Jump to