{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-46141", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-10-17T07:04:03.576Z", "datePublished": "2023-12-14T14:05:11.292Z", "dateUpdated": "2023-12-14T14:05:11.292Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Automation Worx Software Suite", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "AXC 1050", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "AXC 1050 XC", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "AXC 3050", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Config+", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "FC 350 PCI ETH", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "ILC1x0", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "ILC1x1", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "ILC 3xx", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "PC Worx", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "PC Worx Express", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "PC WORX RT BASIC", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "PC WORX SRT", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "RFC 430 ETH-IB", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "RFC 450 ETH-IB", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "RFC 460R PN 3TX", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "RFC 470S PN 3TX", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "RFC 480S PN 4TX", "vendor": "PHOENIX CONTACT", "versions": [{"status": "affected", "version": "all"}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Reid Wightman of Dragos, Inc."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device."}], "value": "Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2023-12-14T14:05:11.292Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-055/"}], "source": {"advisory": "VDE-2023-055", "defect": ["CERT@VDE#64608"], "discovery": "EXTERNAL"}, "title": "Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phoenixcontact:automationworx_software_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "9797B615-825F-4CAA-B36E-5161E37FAF9A", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:axc_1050_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F0D586DC-2274-4A32-AE98-7BE174C230CC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:axc_1050:-:*:*:*:*:*:*:*", "matchCriteriaId": "5F55C821-DAA6-4098-BB54-80F6D9ED0CD6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:axc_1050_xc_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "332A6164-CDC1-4DBF-9B62-946EC7D7C4B3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:axc_1050_xc:-:*:*:*:*:*:*:*", "matchCriteriaId": "E03B5234-36FA-4BCE-964D-F55FFFD5CAAC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:axc_3050_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "84066F7B-8306-4743-9F12-75B8F880AD93", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:axc_3050:-:*:*:*:*:*:*:*", "matchCriteriaId": "CB9699A2-782D-40F3-B8D6-3C315104BA60", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phoenixcontact:config\\+:*:*:*:*:*:*:*:*", "matchCriteriaId": "A6D8FDB6-6181-49EB-BE6D-236D39A478A1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fc_350_pci_eth_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "DEB7CA5B-7EEF-4E0E-9A53-83FE28730852", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fc_350_pci_eth:-:*:*:*:*:*:*:*", "matchCriteriaId": "F4BB6654-41BB-488E-AC8C-E74C05CA198F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:ilc1x0_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AC07A81-D5D6-449C-93F8-93D6E87487DD", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:ilc1x0:-:*:*:*:*:*:*:*", "matchCriteriaId": "AE45F6AF-7286-48F7-B4BE-AFC948884C7C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:ilc1x1_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E168AB1-1B81-4990-95E4-56C36275609B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:ilc1x1:-:*:*:*:*:*:*:*", "matchCriteriaId": "9E318A8B-D1D1-4DD5-AF71-DCBFEFCF2C5E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:ilc_3xx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "65E1A201-E7B1-452B-8BC6-A355A3BF9460", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:ilc_3xx:-:*:*:*:*:*:*:*", "matchCriteriaId": "FF1C58A6-5220-4509-B426-D1ED5ECFAD05", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phoenixcontact:pc_worx:*:*:*:*:*:*:*:*", "matchCriteriaId": "B975C4E4-83B5-4C98-811B-E6D13687AB85", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phoenixcontact:pc_worx_express:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE663FFA-4B82-4477-A424-4C9CC83C131E", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:pc_worx_rt_basic_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8693B231-3A5C-47B7-BEA5-53D430BBACF4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:pc_worx_rt_basic:-:*:*:*:*:*:*:*", "matchCriteriaId": "08B214FC-776F-454B-8DC4-E7F2E6EFB013", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phoenixcontact:pc_worx_srt:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2A6F462-A12F-4E08-9AA6-1C1AF743A645", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:rfc_430_eth-ib_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "643E47A5-E7AA-4321-99A1-05EEBD9A2B56", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:rfc_430_eth-ib:-:*:*:*:*:*:*:*", "matchCriteriaId": "1F32F262-519C-41BB-BF31-ECBCAC1ABEA9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:rfc_450_eth-ib_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A91E019B-F0C5-4DF0-AE4C-E60F3D598F0C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:rfc_450_eth-ib:-:*:*:*:*:*:*:*", "matchCriteriaId": "C3C2EDF4-2982-4858-A960-7E7564E5B20A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:rfc_460r_pn_3tx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "302995A9-E9CC-4477-B374-CE10F16A5E10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:rfc_460r_pn_3tx:-:*:*:*:*:*:*:*", "matchCriteriaId": "F7544E2C-2E63-4C36-AB64-764B4393E377", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:rfc_470s_pn_3tx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CCAB2CA6-EEC4-4E0D-B962-FC2C4EF06013", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:rfc_470s_pn_3tx:-:*:*:*:*:*:*:*", "matchCriteriaId": "CD94CBFF-CC25-4122-96FE-2308A4D1659D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:rfc_480s_pn_4tx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B383246-EF0A-466F-89EA-F61AFC447509", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:rfc_480s_pn_4tx:-:*:*:*:*:*:*:*", "matchCriteriaId": "6B043176-58CC-438C-92D9-99F479BB1C58", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device."}, {"lang": "es", "value": "La asignaci\u00f3n de permisos incorrecta para una vulnerabilidad de recursos cr\u00edticos en varios productos de la l\u00ednea cl\u00e1sica de PHOENIX CONTACT permite que un atacante remoto no autenticado obtenga acceso completo al dispositivo afectado."}], "id": "CVE-2023-46141", "lastModified": "2023-12-21T17:14:56.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "info@cert.vde.com", "type": "Primary"}]}, "published": "2023-12-14T14:15:42.767", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2023-055/"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "info@cert.vde.com", "type": "Primary"}]}

{}