CVE-2023-3526: PHOENIX CONTACT: Cross-site Scripting vulnerability in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devices

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-08 · updated 2026-06-17
Weakness: CWE-79

Description

In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user's browser.

Affected products

Phoenixcontact Cloud Client 1101T-Tx Firmware: before 2.06.10 — fixed in 2.06.10
Phoenixcontact Tc Cloud Client 1002-4G Att Firmware: before 2.07.2 — fixed in 2.07.2
Phoenixcontact Tc Cloud Client 1002-4G Firmware: before 2.07.2 — fixed in 2.07.2
Phoenixcontact Tc Cloud Client 1002-4G Vzw Firmware: before 2.07.2 — fixed in 2.07.2
Phoenixcontact Tc Router 3002T-4G Att Firmware: before 2.07.2 — fixed in 2.07.2
Phoenixcontact Tc Router 3002T-4G Firmware: before 2.07.2 — fixed in 2.07.2
Phoenixcontact Tc Router 3002T-4G Vzw Firmware: before 2.07.2 — fixed in 2.07.2

How to fix

Upgrade to a fixed version: Phoenixcontact Cloud Client 1101T-Tx Firmware 2.06.10; Phoenixcontact Tc Cloud Client 1002-4G Att Firmware 2.07.2; Phoenixcontact Tc Cloud Client 1002-4G Firmware 2.07.2; Phoenixcontact Tc Cloud Client 1002-4G Vzw Firmware 2.07.2; Phoenixcontact Tc Router 3002T-4G Att Firmware 2.07.2; Phoenixcontact Tc Router 3002T-4G Firmware 2.07.2; Phoenixcontact Tc Router 3002T-4G Vzw Firmware 2.07.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-3526 or the next vulnerability affects your stack