ICS Advisory: Phoenix Contact TC ROUTER and TC CLOUD CLIENT

Here is a summary of the provided document:

Summary:

Phoenix Contact has released an advisory regarding vulnerabilities in their TC ROUTER and TC CLOUD CLIENT equipment. The vulnerabilities, identified as Cross-site Scripting (CVE-2023-3526) and XML Entity Expansion (CVE-2023-3569), have a CVSS v3 base score of 9.6 and 4.9, respectively. The vulnerabilities can allow an attacker to execute code in the context of the user's browser or cause a denial of service. The affected products include TC ROUTER 3002T-4G, TC CLOUD CLIENT 1002-4G, and CLOUD CLIENT 1101T-TX/TX, with prior versions of each being vulnerable. Phoenix Contact has released fixed versions to mitigate the vulnerabilities, and recommendations include operating devices in closed networks or protected with a suitable firewall, minimizing network exposure, and implementing defensive measures such as firewalls and VPNs.