CVE-2017-16741

Vulnerability

An information exposure vulnerability exists in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32 [1]. A remote unauthenticated attacker can enable Monitor Mode on the device to read diagnostic information [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by using Monitor Mode on the device without any prior authentication or user interaction [1]. No special network position is required beyond network access to the affected device [1].

Impact

Successful exploitation allows the attacker to read diagnostic information from the device, leading to information exposure [1]. The attacker does not gain administrative privileges from this specific vulnerability, but the exposed diagnostic data may aid further attacks [1].

Mitigation

PHOENIX CONTACT recommends upgrading to firmware Version 1.33 or higher, which fixes the vulnerability [1]. The updated firmware can be downloaded from the vendor's website for each affected model [1].