CVE-2023-46141

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-46141
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cert.vde.com/en/advisories/VDE-2023-055/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:phoenixcontact:automationworx_software_suite:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:phoenixcontact:axc_1050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axc_1050:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:phoenixcontact:axc_1050_xc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axc_1050_xc:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:phoenixcontact:axc_3050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axc_3050:-:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:a:phoenixcontact:config\+:*:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:phoenixcontact:fc_350_pci_eth_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:fc_350_pci_eth:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:phoenixcontact:ilc1x0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:ilc1x0:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:phoenixcontact:ilc1x1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:ilc1x1:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:phoenixcontact:ilc_3xx_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:ilc_3xx:-:*:*:*:*:*:*:*

Configuration 10 (hide)

cpe:2.3:a:phoenixcontact:pc_worx:*:*:*:*:*:*:*:*

Configuration 11 (hide)

cpe:2.3:a:phoenixcontact:pc_worx_express:*:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:phoenixcontact:pc_worx_rt_basic_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:pc_worx_rt_basic:-:*:*:*:*:*:*:*

Configuration 13 (hide)

cpe:2.3:a:phoenixcontact:pc_worx_srt:*:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:phoenixcontact:rfc_430_eth-ib_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:rfc_430_eth-ib:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:phoenixcontact:rfc_450_eth-ib_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:rfc_450_eth-ib:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:phoenixcontact:rfc_460r_pn_3tx_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:rfc_460r_pn_3tx:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:phoenixcontact:rfc_470s_pn_3tx_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:rfc_470s_pn_3tx:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:phoenixcontact:rfc_480s_pn_4tx_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:rfc_480s_pn_4tx:-:*:*:*:*:*:*:*
History

21 Dec 2023, 17:14

Type Values Removed Values Added
Summary
  • (es) La asignación de permisos incorrecta para una vulnerabilidad de recursos críticos en varios productos de la línea clásica de PHOENIX CONTACT permite que un atacante remoto no autenticado obtenga acceso completo al dispositivo afectado.
CPE cpe:2.3:h:phoenixcontact:ilc1x1:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:rfc_430_eth-ib:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:rfc_480s_pn_4tx:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:pc_worx_rt_basic:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:rfc_470s_pn_3tx:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:fc_350_pci_eth_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axc_1050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:fc_350_pci_eth:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:ilc_3xx:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:rfc_450_eth-ib:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:rfc_430_eth-ib_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:rfc_470s_pn_3tx_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axc_3050:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:ilc_3xx_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:phoenixcontact:pc_worx:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axc_1050_xc:-:*:*:*:*:*:*:*
cpe:2.3:a:phoenixcontact:pc_worx_srt:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axc_1050_xc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:ilc1x1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axc_1050:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:rfc_460r_pn_3tx_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:pc_worx_rt_basic_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:ilc1x0:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:ilc1x0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:phoenixcontact:pc_worx_express:*:*:*:*:*:*:*:*
cpe:2.3:a:phoenixcontact:automationworx_software_suite:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:rfc_450_eth-ib_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:rfc_460r_pn_3tx:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axc_3050_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:rfc_480s_pn_4tx_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:phoenixcontact:config\+:*:*:*:*:*:*:*:*
References () https://cert.vde.com/en/advisories/VDE-2023-055/ - () https://cert.vde.com/en/advisories/VDE-2023-055/ - Third Party Advisory
First Time Phoenixcontact rfc 450 Eth-ib
Phoenixcontact rfc 450 Eth-ib Firmware
Phoenixcontact ilc1x1 Firmware
Phoenixcontact rfc 470s Pn 3tx
Phoenixcontact pc Worx Express
Phoenixcontact pc Worx Rt Basic
Phoenixcontact pc Worx Srt
Phoenixcontact automationworx Software Suite
Phoenixcontact fc 350 Pci Eth Firmware
Phoenixcontact rfc 430 Eth-ib Firmware
Phoenixcontact axc 1050
Phoenixcontact rfc 430 Eth-ib
Phoenixcontact axc 3050 Firmware
Phoenixcontact axc 1050 Firmware
Phoenixcontact rfc 480s Pn 4tx Firmware
Phoenixcontact rfc 470s Pn 3tx Firmware
Phoenixcontact
Phoenixcontact rfc 460r Pn 3tx Firmware
Phoenixcontact pc Worx
Phoenixcontact config\+
Phoenixcontact pc Worx Rt Basic Firmware
Phoenixcontact ilc1x1
Phoenixcontact rfc 460r Pn 3tx
Phoenixcontact axc 3050
Phoenixcontact ilc1x0 Firmware
Phoenixcontact rfc 480s Pn 4tx
Phoenixcontact fc 350 Pci Eth
Phoenixcontact ilc 3xx Firmware
Phoenixcontact ilc 3xx
Phoenixcontact axc 1050 Xc
Phoenixcontact axc 1050 Xc Firmware
Phoenixcontact ilc1x0

14 Dec 2023, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-14 14:15

Updated : 2023-12-21 17:14

NVD link : CVE-2023-46141

Mitre link : CVE-2023-46141

CVE.ORG link : CVE-2023-46141

JSON object : View

Products Affected

phoenixcontact

  • rfc_480s_pn_4tx
  • rfc_450_eth-ib_firmware
  • automationworx_software_suite
  • fc_350_pci_eth
  • axc_1050_firmware
  • ilc1x0_firmware
  • pc_worx_express
  • pc_worx_rt_basic_firmware
  • ilc1x1
  • axc_3050
  • config\+
  • rfc_430_eth-ib_firmware
  • rfc_480s_pn_4tx_firmware
  • rfc_460r_pn_3tx_firmware
  • rfc_460r_pn_3tx
  • ilc_3xx_firmware
  • pc_worx
  • rfc_430_eth-ib
  • axc_1050
  • fc_350_pci_eth_firmware
  • ilc1x0
  • ilc1x1_firmware
  • axc_3050_firmware
  • rfc_470s_pn_3tx_firmware
  • rfc_470s_pn_3tx
  • ilc_3xx
  • pc_worx_srt
  • pc_worx_rt_basic
  • axc_1050_xc_firmware
  • axc_1050_xc
  • rfc_450_eth-ib
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource