CVE-2023-46144

PHOENIX CONTACT: PLCnext Control prone to download of code without integrity check

State: Published
Severity: 6.5 Medium
Published: Dec 14, 2023
Updated: Oct 1, 2024
Reserved: Oct 17, 2023

Description

A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	CERTVDE

Weaknesses

CWE-494 Download of Code Without Integrity Check

Affected Products

Product	Versions
AXC F 1152PHOENIX CONTACT	2024.0 and earlierAffected
AXC F 2152PHOENIX CONTACT	2024.0 and earlierAffected
AXC F 3152PHOENIX CONTACT	2024.0 and earlierAffected
BPC 9102SPHOENIX CONTACT	2024.0 and earlierAffected
EPC 1502PHOENIX CONTACT	2024.0 and earlierAffected
EPC 1522PHOENIX CONTACT	2024.0 and earlierAffected
PLCnext EngineerPHOENIX CONTACT	2024.0 and earlierAffected
RFC 4072RPHOENIX CONTACT	2024.0 and earlierAffected
RFC 4072SPHOENIX CONTACT	2024.0 and earlierAffected

References

https://https//cert.vde.com/en/advisories/VDE-2023-056/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.