CVE-2023-0757

The vulnerability stems from improper permission assignment to critical system resources (CWE-732). An attacker without any authentication can remotely upload arbitrary malicious code to the vulnerable device over the network. The absence of user interaction requirements and low attack complexity make this vulnerability particularly easy to exploit.

The attacker gains full access to the device, enabling arbitrary code execution, system control takeover, and potential disruption of industrial processes. This results in complete loss of confidentiality, integrity, and availability of device resources.

Apply patches available from the manufacturer according to references (https://cert.vde.com/en/advisories/VDE-2023-051/). Until updates are deployed, it is recommended to isolate devices from the network, restrict network access using firewalls, and implement the principle of least privilege in network infrastructure.

PHOENIX CONTACT MULTIPROG and PHOENIX CONTACT ProConOS eCLR (SDK) — specific versions indicated in manufacturer references (cert.vde.com, VDE-2023-051)