cve/2020/CVE-2020-12519.md

### [CVE-2020-12519](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12519)
![](https://img.shields.io/static/v1?label=Product&message=AXC%20F%201152%20(1151412)&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=AXC%20F%202152%20(2404267)&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=AXC%20F%202152%20Starterkit%20(1046568)&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=AXC%20F%203152%20(1069208)&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=PLCnext%20Technology%20Starterkit%20(1188165)&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=RFC%204072S%20(1051328&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%202021.0%20LTS%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-269%20Improper%20Privilege%20Management&color=brighgreen)

### Description

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges.

### POC

#### Reference
- https://cert.vde.com/en-us/advisories/vde-2020-049
- https://cert.vde.com/en-us/advisories/vde-2020-049

#### Github
No PoCs found on GitHub currently.