Critical severity · published Dec 14, 2023
CVE-2023-46141
Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A1
AXC 1050 · PHOENIX CONTACT
All versions, or not specified · source: vendor
A1
AXC 1050 XC · PHOENIX CONTACT
All versions, or not specified · source: vendor
A3
AXC 3050 · PHOENIX CONTACT
All versions, or not specified · source: vendor
AW
Automation Worx Software Suite · PHOENIX CONTACT
All versions, or not specified · source: vendor
CO
Config+ · PHOENIX CONTACT
All versions, or not specified · source: vendor, NVD
F3
FC 350 PCI ETH · PHOENIX CONTACT
All versions, or not specified · source: vendor
I3
ILC 3xx · PHOENIX CONTACT
All versions, or not specified · source: vendor
IL
ILC1x0 · PHOENIX CONTACT
All versions, or not specified · source: vendor
IL
ILC1x1 · PHOENIX CONTACT
All versions, or not specified · source: vendor
PW
PC WORX RT BASIC · PHOENIX CONTACT
All versions, or not specified · source: vendor
PW
PC WORX SRT · PHOENIX CONTACT
All versions, or not specified · source: vendor, NVD
PW
PC Worx · PHOENIX CONTACT
All versions, or not specified · source: vendor, NVD
Affected product
AW
Automation Worx Software Suite
PHOENIX CONTACT
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46141
Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2023-055/
More from Automation Worx Software Suite
7.5
CVE-2023-46143
Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC