CVE-2023-3526

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
PHOENIX CONTACTCLOUD CLIENT 1101T-TX/TX< 2.06.10
PHOENIX CONTACTTC CLOUD CLIENT 1002-4G< 2.07.2
PHOENIX CONTACTTC CLOUD CLIENT 1002-4G ATT< 2.07.2
PHOENIX CONTACTTC CLOUD CLIENT 1002-4G VZW< 2.07.2
PHOENIX CONTACTTC ROUTER 3002T-4G< 2.07.2
PHOENIX CONTACTTC ROUTER 3002T-4G ATT< 2.07.2
PHOENIX CONTACTTC ROUTER 3002T-4G VZW< 2.07.2

References

Timeline

Published
Aug 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-35276.8A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with adminiCVE-2023-35289.8A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unknown functionality of CVE-2023-35297.5A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the filCVE-2023-352966.5Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-352978.1Windows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityCVE-2023-352987.5HTTP.sys Denial of Service VulnerabilityCVE-2023-352997.8Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2023-353008.8Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2023-353028.8Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-353038.8USB Audio Class System Driver Remote Code Execution VulnerabilityCVE-2023-353047.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2023-353057.8Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-3526: Critical severity, CVSS 9.6 | Vulnix