Critical severity · published Dec 14, 2023
CVE-2023-46141
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full…
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Automationworx Software Suite · Phoenixcontact
All versions, or not specified · source: NVD
A1
Axc 1050 Firmware · Phoenixcontact
All versions, or not specified · source: NVD
A1
Axc 1050 XC Firmware · Phoenixcontact
All versions, or not specified · source: NVD
A3
Axc 3050 Firmware · Phoenixcontact
All versions, or not specified · source: NVD
CO
Config+ · Phoenixcontact
All versions, or not specified · source: NVD
F3
FC 350 Pci Eth Firmware · Phoenixcontact
All versions, or not specified · source: NVD
I3
Ilc 3xx Firmware · Phoenixcontact
All versions, or not specified · source: NVD
IF
Ilc1x0 Firmware · Phoenixcontact
All versions, or not specified · source: NVD
IF
Ilc1x1 Firmware · Phoenixcontact
All versions, or not specified · source: NVD
PW
PC Worx · Phoenixcontact
All versions, or not specified · source: NVD
PW
PC Worx Express · Phoenixcontact
All versions, or not specified · source: NVD
PW
PC Worx RT Basic Firmware · Phoenixcontact
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46141
Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2023-055/
More from Automationworx Software Suite
8.8
CVE-2019-12870
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86
8.8
CVE-2019-12869
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86
8.8
CVE-2019-12871
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86
7.8
CVE-2022-3737
In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data
7.8
CVE-2022-3461
In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could lead to a heap buffer overflow and a read access violation