CVE-2020-12518

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Phoenix Contact	AXC F 1152 (1151412)	>= unspecified, < 2021.0 LTS
Phoenix Contact	AXC F 2152 (2404267)	>= unspecified, < 2021.0 LTS
Phoenix Contact	AXC F 3152 (1069208)	>= unspecified, < 2021.0 LTS
Phoenix Contact	RFC 4072S (1051328	>= unspecified, < 2021.0 LTS
Phoenix Contact	AXC F 2152 Starterkit (1046568)	>= unspecified, < 2021.0 LTS
Phoenix Contact	PLCnext Technology Starterkit (1188165)	>= unspecified, < 2021.0 LTS

References

https://cert.vde.com/en-us/advisories/vde-2020-049Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2020-049Third Party Advisory

Timeline

Published: Dec 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-125199.8On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell wi CVE-2020-12527.8<p>A remote code execution vulnerability exists when Windows improperly handles objects in memory. To exploit the vulnerability an attacker CVE-2020-125216.5On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the CVE-2020-125229.8The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Se CVE-2020-125239.1On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device config CVE-2020-125247.5Uncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to b CVE-2020-125257.8M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrus CVE-2020-125265.3TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co.CVE-2020-125276.5An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11 CVE-2020-125287.7An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. Improper use of access val CVE-2020-125295.3An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAP CVE-2020-12536.7An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, ak