CVE-2023-46142

PHOENIX CONTACT: Insufficient Read and Write Protection to Logic and Runtime Data in PLCnext Control

State: Published
Severity: 8.8 High
Published: Dec 14, 2023
Updated: Aug 2, 2024
Reserved: Oct 17, 2023

Description

A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
AXC F 1152PHOENIX CONTACT	2024.0 and earlierAffected
AXC F 2152PHOENIX CONTACT	2024.0 and earlierAffected
AXC F 3152PHOENIX CONTACT	2024.0 and earlierAffected
BPC 9102SPHOENIX CONTACT	2024.0 and earlierAffected
EPC 1502PHOENIX CONTACT	2024.0 and earlierAffected
EPC 1522PHOENIX CONTACT	2024.0 and earlierAffected
PLCnext EngineerPHOENIX CONTACT	2024.0 and earlierAffected
RFC 4072RPHOENIX CONTACT	2024.0 and earlierAffected
RFC 4072SPHOENIX CONTACT	2024.0 and earlierAffected

References

https://https//cert.vde.com/en/advisories/VDE-2023-056/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.