CRITICAL🇵🇱 Wersja polska

CVE-2023-46141

CVSS 9.8v3.1pub. 2023-12-14upd. 2024-11-21

Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.

🤖 AI Analysis
How it works

The vulnerability results from improper assignment of permissions to critical resources (CWE-732). Due to misconfigured or insufficiently restrictive permissions on key system resources, an attacker can access them without requiring authentication. The attack is possible remotely over the network, without user interaction, and without any prerequisites on the attacker's side.

Impact

An attacker can gain full control over the vulnerable device, which includes reading and modifying configuration, manipulating control processes, and potentially disrupting or stopping the operation of industrial installation.

Mitigation & patch

Apply patches available from the manufacturer according to references (https://cert.vde.com/en/advisories/VDE-2023-055/). Until updates are implemented, it is recommended to isolate vulnerable devices from the network, restrict access to them only from trusted hosts using a firewall, and avoid directly exposing devices to public networks.

Who is affected

Phoenix Contact Automation Worx Software Suite, Phoenix Contact AXC 1050 (Firmware), Phoenix Contact AXC 1050 XC (Firmware) — exact versions indicated in manufacturer references (CERT@VDE VDE-2023-055)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Phoenixcontact Automationworx Software Suite

    APP
    Phoenixcontact
    all versions

  • Phoenixcontact Axc 1050

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Axc 1050 Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Axc 1050 Xc

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Axc 1050 Xc Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Axc 3050

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Axc 3050 Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Config\+

    APP
    Phoenixcontact
    all versions

  • Phoenixcontact Fc 350 Pci Eth

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Fc 350 Pci Eth Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Ilc1x0

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Ilc1x0 Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Ilc1x1

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Ilc1x1 Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Ilc 3xx

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Ilc 3xx Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Pc Worx

    APP
    Phoenixcontact
    all versions

  • Phoenixcontact Pc Worx Express

    APP
    Phoenixcontact
    all versions

  • Phoenixcontact Pc Worx Rt Basic

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Pc Worx Rt Basic Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Pc Worx Srt

    APP
    Phoenixcontact
    all versions

  • Phoenixcontact Rfc 430 Eth Ib

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Rfc 430 Eth Ib Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Rfc 450 Eth Ib

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Rfc 450 Eth Ib Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Rfc 460r Pn 3tx

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Rfc 460r Pn 3tx Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Rfc 470s Pn 3tx

    HW
    Phoenixcontact
    all versions

  • Phoenixcontact Rfc 470s Pn 3tx Firmware

    OS
    Phoenixcontact
    all versions

  • Phoenixcontact Rfc 480s Pn 4tx

    HW
    Phoenixcontact
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2022-31800CRITICAL9.8PL ✓same product

Phoenix Contact AXC: nieautoryzowane wgranie złośliwego kodu do sterownika PLC

CVE-2019-9201CRITICAL9.8PL ✓same product

Phoenix Contact ILC — brak uwierzytelnienia na porcie 1962 (dostęp zdalny)

CVE-2023-46143HIGH7.5same product

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthen...

CVE-2022-3737HIGH7.8same product

In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended sco...

CVE-2022-3461HIGH7.8same product

In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could...