Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers
CVE-2022-31800

9.8CRITICAL

Key Information:

Vendor: Phoenix Contact
Status: Ilc 1x0; Ilc 1x1; Ilc 1x1 Gsm/gprs; Ilc 3xx
Vendor: CVE Published:; 21 June 2022

Summary

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.

Affected Version(s)

AXC 1050 All Versions

AXC 1050 XC All Versions

AXC 3050 All Versions

References

https://cert.vde.com/en/advisories/VDE-2022-025/

x_refsource_CONFIRM

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Jun 21, 2022
Vulnerability Reserved
May 30, 2022

Credit

This vulnerability was reported by Forescout.