{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "aggregate_severity": { "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale", "text": "Medium" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The Weidmueller security routers IE-SR-4TX and IE-SR-4GT in firmware releases prior to 2.3.4 bundle a PHP version that is affected by CVE-2026-109618. In the configuration used by the products, the vulnerability can allow an attacker to cause a denial of service by making the web interface temporarily unavailable. All other functions (Routing, Firewall etc.) are not affected. It is fixed in firmware 2.3.4. CVE-2026-109619, which was published together with CVE-2026-109618, does not affect the products.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Weidmueller strongly recommends to change the default passwords and to minimize the network exposure of products. Limit access to trusted networks by using the appropriate mechanisms.", "title": "General Recommendation" }, { "category": "description", "text": "An unauthenticated remote attacker with network access to the web interface can make it temporarily unavailable. Confidentiality and integrity are not affected; only availability of the web interface is impacted.", "title": "Impact" }, { "category": "description", "text": "Restrict access to the web interface to trusted networks.", "title": "Mitigation" }, { "category": "description", "text": "Update to version 2.3.4 or later.\n\n| Product | Article Number | Firmware File Name | Affected Version | Fixed Version |\n|---|---|---|---|---|\n| IE-SR-4TX | 2751270000 | Firmware_IE-SR-4TX_series | <2.3.4 | 2.3.4 |\n| IE-SR-4TX-LTE/4G-EU | 2751280000 | Firmware_IE-SR-4TX_series | <2.3.4 | 2.3.4 |\n| IE-SR-4TX-LTE/4G-USEMEA | 2739630000 | Firmware_IE-SR-4TX_series | <2.3.4 | 2.3.4 |\n| IE-SR-4GT | 2873910000 | Firmware_IE-SR-4GT_series | <2.3.4 | 2.3.4 |\n| IE-SR-4GT-LTE/4G-EU | 2873920000 | Firmware_IE-SR-4GT_series | <2.3.4 | 2.3.4 |\n| IE-SR-4GT-LTE/4G-USEMEA | 2873930000 | Firmware_IE-SR-4GT_series | <2.3.4 | 2.3.4 |\n| IE-SR-4GT-M | 2990450000 | Firmware_IE-SR-4GT_series | <2.3.4 | 2.3.4 |\n| IE-SR-4GT-LTE/4G-USEMEA-M | 2990440000 | Firmware_IE-SR-4GT_series | <2.3.4 | 2.3.4 |\n", "title": "Remediation" } ], "publisher": { "category": "vendor", "contact_details": "psirt@weidmueller.com", "name": "Weidmueller Interface GmbH & Co. KG", "namespace": "https://www.weidmueller.com" }, "references": [ { "category": "external", "summary": "Weidmueller Security Advisory Board", "url": "https://support.weidmueller.com/support-center/popular-resources/security-advisory-board" }, { "category": "external", "summary": "CERT@VDE Security Advisories for Weidmueller", "url": "https://certvde.com/de/advisories/vendor/weidmueller/" }, { "category": "self", "summary": "VDE-2026-152: Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT affected by PHP vulnerability - HTML", "url": "https://certvde.com/de/advisories/VDE-2026-152" }, { "category": "self", "summary": "VDE-2026-152: Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT affected by PHP vulnerability - CSAF", "url": "https://weidmueller.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-152.json" } ], "title": "Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT affected by PHP vulnerability", "tracking": { "aliases": [ "VDE-2026-152", "WMSA-2600006" ], "current_release_date": "2026-11-10T10:00:00.000Z", "generator": { "date": "2026-11-09T17:45:13.548Z", "engine": { "name": "Secvisogram", "version": "2.6.16" } }, "id": "VDE-2026-152", "initial_release_date": "2026-11-10T10:00:00.000Z", "revision_history": [ { "date": "2026-11-10T10:00:00.000Z", "number": "1.0.0", "summary": "Initial version" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "IE-SR-4TX", "product": { "name": "IE-SR-4TX", "product_id": "CSAFPID-11001", "product_identification_helper": { "cpe": "cpe:2.3:h:weidmueller:ie-sr-4tx:*:*:*:*:*:*:*:*", "model_numbers": [ "2751270000" ] } } }, { "category": "product_name", "name": "IE-SR-4TX-LTE/4G-EU", "product": { "name": "IE-SR-4TX-LTE/4G-EU", "product_id": "CSAFPID-11002", "product_identification_helper": { "cpe": "cpe:2.3:h:weidmueller:ie-sr-4tx-lte_4g-eu:*:*:*:*:*:*:*:*", "model_numbers": [ "2751280000" ] } } }, { "category": "product_name", "name": "IE-SR-4TX-LTE/4G-USEMEA", "product": { "name": "IE-SR-4TX-LTE/4G-USEMEA", "product_id": "CSAFPID-11003", "product_identification_helper": { "cpe": "cpe:2.3:h:weidmueller:ie-sr-4tx-lte_4g-usemea:*:*:*:*:*:*:*:*", "model_numbers": [ "2739630000" ] } } }, { "category": "product_name", "name": "IE-SR-4GT", "product": { "name": "IE-SR-4GT", "product_id": "CSAFPID-11004", "product_identification_helper": { "cpe": "cpe:2.3:h:weidmueller:ie-sr-4gt:*:*:*:*:*:*:*:*", "model_numbers": [ "2873910000" ] } } }, { "category": "product_name", "name": "IE-SR-4GT-LTE/4G-EU", "product": { "name": "IE-SR-4GT-LTE/4G-EU", "product_id": "CSAFPID-11005", "product_identification_helper": { "cpe": "cpe:2.3:h:weidmueller:ie-sr-4gt-lte_4g-eu:*:*:*:*:*:*:*:*", "model_numbers": [ "2873920000" ] } } }, { "category": "product_name", "name": "IE-SR-4GT-LTE/4G-USEMEA", "product": { "name": "IE-SR-4GT-LTE/4G-USEMEA", "product_id": "CSAFPID-11006", "product_identification_helper": { "cpe": "cpe:2.3:h:weidmueller:ie-sr-4gt-lte_4g-usemea:*:*:*:*:*:*:*:*", "model_numbers": [ "2873930000" ] } } }, { "category": "product_name", "name": "IE-SR-4GT-M", "product": { "name": "IE-SR-4GT-M", "product_id": "CSAFPID-11007", "product_identification_helper": { "cpe": "cpe:2.3:h:weidmueller:ie-sr-4gt-m:*:*:*:*:*:*:*:*", "model_numbers": [ "2990450000" ] } } }, { "category": "product_name", "name": "IE-SR-4GT-LTE/4G-USEMEA-M", "product": { "name": "IE-SR-4GT-LTE/4G-USEMEA-M", "product_id": "CSAFPID-11008", "product_identification_helper": { "cpe": "cpe:2.3:h:weidmueller:ie-sr-4gt-lte_4g-usemea-m:*:*:*:*:*:*:*:*", "model_numbers": [ "2990440000" ] } } } ], "category": "product_family", "name": "Hardware" }, { "branches": [ { "category": "product_version_range", "name": "vers:semver/>=1.0.0|<2.3.4", "product": { "name": "IE-SR-4TX Firmware 1.0.0<2.3.4", "product_id": "CSAFPID-21001", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4tx_series:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:semver/>=1.0.0|<2.3.4", "product": { "name": "IE-SR-4GT Firmware 1.0.0<2.3.4", "product_id": "CSAFPID-21002", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "2.3.4", "product": { "name": "IE-SR-4TX Firmware 2.3.4", "product_id": "CSAFPID-22001", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4tx_series:2.3.4:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "2.3.4", "product": { "name": "IE-SR-4GT Firmware 2.3.4", "product_id": "CSAFPID-22002", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:2.3.4:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Firmware" } ], "category": "vendor", "name": "Weidmueller" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/>=8.2.0|<8.2.35", "product": { "name": "PHP 8.2.0<8.2.35", "product_id": "CSAFPID-51001", "product_identification_helper": { "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:semver/>=8.3.0|<8.3.36", "product": { "name": "PHP 8.3.0<8.3.36", "product_id": "CSAFPID-51002", "product_identification_helper": { "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:semver/>=8.4.0|<8.4.27", "product": { "name": "PHP 8.4.0<8.4.27", "product_id": "CSAFPID-51003", "product_identification_helper": { "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:semver/>=8.5.0|<8.5.12", "product": { "name": "PHP 8.5.0<8.5.12", "product_id": "CSAFPID-51004", "product_identification_helper": { "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "8.2.35", "product": { "name": "PHP 8.2.35", "product_id": "CSAFPID-52001", "product_identification_helper": { "cpe": "cpe:2.3:a:php:php:8.2.35:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "8.3.36", "product": { "name": "PHP 8.3.36", "product_id": "CSAFPID-52002", "product_identification_helper": { "cpe": "cpe:2.3:a:php:php:8.3.36:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "8.4.27", "product": { "name": "PHP 8.4.27", "product_id": "CSAFPID-52003", "product_identification_helper": { "cpe": "cpe:2.3:a:php:php:8.4.27:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "8.5.12", "product": { "name": "PHP 8.5.12", "product_id": "CSAFPID-52004", "product_identification_helper": { "cpe": "cpe:2.3:a:php:php:8.5.12:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "PHP" } ], "category": "vendor", "name": "PHP Group" } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004" ], "summary": "Affected products (firmware 1.0.0<2.3.4, bundled PHP versions as listed)." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-52001", "CSAFPID-52002", "CSAFPID-52003", "CSAFPID-52004" ], "summary": "Fixed products." } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "IE-SR-4TX Firmware 1.0.0<2.3.4 installed on IE-SR-4TX", "product_id": "CSAFPID-31001", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4tx_series:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4TX Firmware 2.3.4 installed on IE-SR-4TX", "product_id": "CSAFPID-32001", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4tx_series:2.3.4:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4TX Firmware 1.0.0<2.3.4 installed on IE-SR-4TX-LTE/4G-EU", "product_id": "CSAFPID-31002", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4tx_series:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4TX Firmware 2.3.4 installed on IE-SR-4TX-LTE/4G-EU", "product_id": "CSAFPID-32002", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4tx_series:2.3.4:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4TX Firmware 1.0.0<2.3.4 installed on IE-SR-4TX-LTE/4G-USEMEA", "product_id": "CSAFPID-31003", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4tx_series:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4TX Firmware 2.3.4 installed on IE-SR-4TX-LTE/4G-USEMEA", "product_id": "CSAFPID-32003", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4tx_series:2.3.4:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11003" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4GT Firmware 1.0.0<2.3.4 installed on IE-SR-4GT", "product_id": "CSAFPID-31004", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11004" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4GT Firmware 2.3.4 installed on IE-SR-4GT", "product_id": "CSAFPID-32004", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:2.3.4:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11004" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4GT Firmware 1.0.0<2.3.4 installed on IE-SR-4GT-LTE/4G-EU", "product_id": "CSAFPID-31005", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11005" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4GT Firmware 2.3.4 installed on IE-SR-4GT-LTE/4G-EU", "product_id": "CSAFPID-32005", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:2.3.4:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11005" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4GT Firmware 1.0.0<2.3.4 installed on IE-SR-4GT-LTE/4G-USEMEA", "product_id": "CSAFPID-31006", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11006" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4GT Firmware 2.3.4 installed on IE-SR-4GT-LTE/4G-USEMEA", "product_id": "CSAFPID-32006", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:2.3.4:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11006" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4GT Firmware 1.0.0<2.3.4 installed on IE-SR-4GT-M", "product_id": "CSAFPID-31007", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11007" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4GT Firmware 2.3.4 installed on IE-SR-4GT-M", "product_id": "CSAFPID-32007", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:2.3.4:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11007" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4GT Firmware 1.0.0<2.3.4 installed on IE-SR-4GT-LTE/4G-USEMEA-M", "product_id": "CSAFPID-31008", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11008" }, { "category": "installed_on", "full_product_name": { "name": "IE-SR-4GT Firmware 2.3.4 installed on IE-SR-4GT-LTE/4G-USEMEA-M", "product_id": "CSAFPID-32008", "product_identification_helper": { "cpe": "cpe:2.3:o:weidmueller:firmware_ie-sr-4gt_series:2.3.4:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11008" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-109618", "cwe": { "id": "CWE-755", "name": "Improper Handling of Exceptional Conditions" }, "notes": [ { "audience": "all", "category": "description", "text": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).", "title": "CVE description" }, { "audience": "all", "category": "details", "text": "The published rating of CVE-2026-109618 (CVSS v3.1 base score 9.8, CVSS v4.0 base score 9.2) assumes that the out-of-memory condition leads to remote code execution. Upstream confirmed this for PHP server APIs that run the request cleanup on the inconsistent engine state and keep using the PHP process afterwards, such as Apache mod_php.\n\nThe Weidmueller products do not use mod_php or PHP-FPM. They run exactly one PHP worker process (php-cgi, without threads) behind the web server; the web server passes the requests to it through a local FastCGI socket, and it handles them one after another. There is no pool of PHP processes. The out-of-memory strategies described upstream exhaust the memory while PHP parses the request data during request startup. When request startup fails, php-cgi does not run the request cleanup on the inconsistent engine state: it shuts down the PHP engine and the worker process exits. As it is the only PHP process, no PHP process with the inconsistent state remains; the operating system releases its memory, and the inconsistent state is never used. Upstream describes the same behavior for PHP-FPM, which ends the worker process when request startup fails and thereby prevents the use of the invalid state. A watchdog then starts a new worker with a fresh memory state.\n\nConfidentiality and integrity are therefore not affected. The only impact is that the web interface is unavailable until the PHP worker has been restarted. This results in the product-specific rating listed as Score 1: CVSS v3.1 base score 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and CVSS v4.0 base score 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, see References). Score 2 is the original rating published for the CVE; it applies to the affected PHP versions.", "title": "CVE Characterization" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-52001", "CSAFPID-52002", "CSAFPID-52003", "CSAFPID-52004" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004" ] }, "references": [ { "category": "external", "summary": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" }, { "category": "external", "summary": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - 9.2 / Critical", "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "category": "external", "summary": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - 6.9 / Medium (product-specific rating for the Weidmueller products, see CVE Characterization)", "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" } ], "remediations": [ { "category": "mitigation", "details": "Restrict access to the web interface to trusted networks.", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004" ] }, { "category": "vendor_fix", "details": "Update to firmware 2.3.4 or later.", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008" ] }, { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004" ] } ], "title": "Out-of-memory handling flaw in bundled PHP" } ] }