Riskcovery

CVE-2023-46141

Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource

State
Published
Severity
9.8 Critical
Published
Dec 14, 2023
Updated
Aug 2, 2024
Reserved
Oct 17, 2023

Read the record on cve.org

Description

Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCERTVDE

Weaknesses

  • CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

ProductVersions
Automation Worx Software SuitePHOENIX CONTACT
  • allAffected
AXC 1050PHOENIX CONTACT
  • allAffected
AXC 1050 XCPHOENIX CONTACT
  • allAffected
AXC 3050PHOENIX CONTACT
  • allAffected
Config+PHOENIX CONTACT
  • allAffected
FC 350 PCI ETHPHOENIX CONTACT
  • allAffected
ILC1x0PHOENIX CONTACT
  • allAffected
ILC1x1PHOENIX CONTACT
  • allAffected
ILC 3xxPHOENIX CONTACT
  • allAffected
PC WorxPHOENIX CONTACT
  • allAffected
PC Worx ExpressPHOENIX CONTACT
  • allAffected
PC WORX RT BASICPHOENIX CONTACT
  • allAffected
PC WORX SRTPHOENIX CONTACT
  • allAffected
RFC 430 ETH-IBPHOENIX CONTACT
  • allAffected
RFC 450 ETH-IBPHOENIX CONTACT
  • allAffected
RFC 460R PN 3TXPHOENIX CONTACT
  • allAffected
RFC 470S PN 3TXPHOENIX CONTACT
  • allAffected
RFC 480S PN 4TXPHOENIX CONTACT
  • allAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.