Medium severity · published Dec 14, 2023
CVE-2023-46144
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering…
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Axc F 1152 Firmware · Phoenixcontact
through 2024.0 · source: NVD
AF
Axc F 2152 Firmware · Phoenixcontact
through 2024.0 · source: NVD
AF
Axc F 3152 Firmware · Phoenixcontact
through 2024.0 · source: NVD
B9
Bpc 9102s Firmware · Phoenixcontact
through 2024.0 · source: NVD
E1
Epc 1502 Firmware · Phoenixcontact
through 2024.0 · source: NVD
E1
Epc 1522 Firmware · Phoenixcontact
through 2024.0 · source: NVD
PE
Plcnext Engineer · Phoenixcontact
through 2024.0 · source: NVD
R4
Rfc 4072r Firmware · Phoenixcontact
through 2024.0 · source: NVD
R4
Rfc 4072s Firmware · Phoenixcontact
through 2024.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46144
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46144
Broken Link
https://https://cert.vde.com/en/advisories/VDE-2023-056/
More from Axc F 1152 Firmware
8.8
CVE-2023-46142
A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices
7.5
CVE-2021-34570
Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests