CVE-2018-10729

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 allow reading the configuration file by an unauthenticated user.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/104231Third Party Advisory, VDB Entry
https://cert.vde.com/de-de/advisories/vde-2018-005Patch, Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02Patch, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/104231Third Party Advisory, VDB Entry
https://cert.vde.com/de-de/advisories/vde-2018-005Patch, Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02Patch, Third Party Advisory, US Government Resource

Timeline

Published: May 17, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-10735.3The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allo CVE-2018-107309.1All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection.CVE-2018-107319.0All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when hand CVE-2018-107325.3The REST API in Dataiku DSS before 4.2.3 allows remote attackers to obtain sensitive information (i.e., determine if a username is valid) be CVE-2018-107336.5There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0. A crafted input will lead CVE-2018-107349.8KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a Print_Password function call in CVE-2018-107357.2A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.CVE-2018-107367.2A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.CVE-2018-107377.2A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter.CVE-2018-107387.2A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter.CVE-2018-107395.5An issue was discovered in Shanghai 2345 Security Guard 3.7.0. 2345MPCSafe.exe allows local users to bypass intended process protections, an CVE-2018-10747.2ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credential