Paper/Archive/CVE-2022-31800

CVE-2022-31800

PHOENIX CONTACT ILC 1x0 — Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 75.4.754 × 2015.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.

Affected

ProductAffectedFixed inSource

ILC 1x0All Versions–CNA

ILC 1x1All Versions–CNA

ILC 1x1 GSM/GPRSAll Versions–CNA

ILC 3xxAll Versions–CNA

AXC 1050All Versions–CNA

AXC 1050 XCAll Versions–CNA

AXC 3050All Versions–CNA

RFC 480S PN 4TXAll Versions–CNA

RFC 470 PN 3TXAll Versions–CNA

RFC 470S PN 3TXAll Versions–CNA

RFC 460R PN 3TXAll Versions–CNA

RFC 460R PN 3TX-SAll Versions–CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcert.vde.com/en/advisories/VDE-2022-025