TI-2018-12140 Aliases CVE-2018-16994 GHSA-fjq9-2cmr-75cm

An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and…

LOW 36Published 2020-02-18 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices and Bosch Rexroth S20-ETH-BK and Rexroth S20-PN-BK+ (the S20-PN-BK+/S20-ETH-BK fieldbus couplers sold by Bosch Rexroth contain technology from Phoenix Contact). Incorrect handling of a request with non-standard symbols allows remote attackers to initiate a complete lock up of the bus coupler. Authentication of the request is not required.

Why it matters now

EPSS 0.01571 75th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:o:phoenixcontact:axl_f_bk_pn_firmware::::::::	up to 1.0.4	Vulnerable	Phoenixcontact
cpe:2.3:h:phoenixcontact:axl_f_bk_pn:-:::::::*	not specified by NVD	Running on	Phoenixcontact
cpe:2.3:o:phoenixcontact:axl_f_bk_eth_firmware::::::::	up to 1.12	Vulnerable	Phoenixcontact
cpe:2.3:h:phoenixcontact:axl_f_bk_eth:-:::::::*	not specified by NVD	Running on	Phoenixcontact
cpe:2.3:o:phoenixcontact:axl_f_bk_eth_xc_firmware::::::::	up to 1.11	Vulnerable	Phoenixcontact
cpe:2.3:h:phoenixcontact:axl_f_bk_eth_xc:-:::::::*	not specified by NVD	Running on	Phoenixcontact

cpe:2.3:o:phoenixcontact:axl_f_bk_pn_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.4 Vulnerable ·Phoenixcontact
cpe:2.3:h:phoenixcontact:axl_f_bk_pn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
cpe:2.3:o:phoenixcontact:axl_f_bk_eth_firmware:*:*:*:*:*:*:*:* Versions up to 1.12 Vulnerable ·Phoenixcontact
cpe:2.3:h:phoenixcontact:axl_f_bk_eth:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
cpe:2.3:o:phoenixcontact:axl_f_bk_eth_xc_firmware:*:*:*:*:*:*:*:* Versions up to 1.11 Vulnerable ·Phoenixcontact
cpe:2.3:h:phoenixcontact:axl_f_bk_eth_xc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-16994
2026-10-03 Alias added: GHSA-fjq9-2cmr-75cm

References

Advisory 1

https://www.phoenixcontact.com/assets/downloads_ed/local_pc/web_dwl_technical_info/Security_Advirory_CVE-2018-16994.pdf

Other 1

https://psirt.bosch.com/security-advisories/bosch-sa-645125.html

TI-2021-12935 Phoenix Contact: Undocumented FTP acces in certain AXL F BK and IL BK devices CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences