CVE-2018-13990

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 is vulnerable to brute-force attacks, because of Improper Restriction of Excessive Authentication Attempts.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/106737Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-024-02Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/106737Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-024-02Third Party Advisory, US Government Resource

Timeline

Published: May 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-139915.3The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 leaks private information in firmware images.CVE-2018-139929.8The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by CVE-2018-139938.8The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is prone to CSRF.CVE-2018-139947.5The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is vulnerable to a denial-of-service attack by making more than CVE-2018-139969.8Genann through 2018-07-08 has a stack-based buffer over-read in genann_train in genann.c.CVE-2018-139977.5Genann through 2018-07-08 has a SEGV in genann_run in genann.c.CVE-2018-139984.8ClipperCMS 1.3.3 has stored XSS via the Full Name field of (1) Security -> Manager Users or (2) Security -> Web Users.CVE-2018-139994.8Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter (aka an article posted by an administrator).CVE-2018-140017.5An integer overflow vulnerability exists in the function batchTransfer of SHARKTECH (SKT), an Ethereum token smart contract. An attacker cou CVE-2018-140027.5An integer overflow vulnerability exists in the function distribute of MP3 Coin (MP3), an Ethereum token smart contract. An attacker could u CVE-2018-140037.5An integer overflow vulnerability exists in the function batchTransfer of WeMediaChain (WMC), an Ethereum token smart contract. An attacker CVE-2018-140047.5An integer overflow vulnerability exists in the function transfer_tokens_after_ICO of GlobeCoin (GLB), an Ethereum token smart contract. An