PHOENIX CONTACT: PLCnext Control prone to download of code without integrity check
CVE-2023-46144

6.5MEDIUM

Key Information:

Vendor: Phoenix Contact
Status: Axc F 1152; Axc F 2152; Axc F 3152; Bpc 9102s
Vendor: CVE Published:; 14 December 2023

🔔 Create Phoenix Contact Vulnerability Alert

What is CVE-2023-46144?

A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.

Affected Version(s)

AXC F 1152 0 <= 2024.0

AXC F 2152 0 <= 2024.0

AXC F 3152 0 <= 2024.0

References

https://https://cert.vde.com/en/advisories/VDE-2023-056/

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 14, 2023
Vulnerability Reserved
Oct 17, 2023

Credit

Reid Wightman of Dragos, Inc.