Paper/Archive/CVE-2023-46141

CVE-2023-46141

PHOENIX CONTACT Automation Worx Software Suite — Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource

EPSS 0.9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 59.1.591 × 2011.8 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.

Affected

ProductAffectedFixed inSource

Automation Worx Software Suiteall–CNA

AXC 1050all–CNA

AXC 1050 XCall–CNA

AXC 3050all–CNA

Config+all–CNA

FC 350 PCI ETHall–CNA

ILC1x0all–CNA

ILC1x1all–CNA

ILC 3xxall–CNA

PC Worxall–CNA

PC Worx Expressall–CNA

PC WORX RT BASICall–CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refcert.vde.com/en/advisories/VDE-2023-055