CVE-2023-46142

PHOENIX CONTACT: Insufficient Read and Write Protection to Logic and Runtime Data in PLCnext Control

High8.8EPSS 0.74%

Published: 14 Dec 2023
Updated: 2 Aug 2024
Reserved: 17 Oct 2023
Assigned by: CERTVDE

Description

A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.

Scores

CVSS scores of CVE-2023-46142, by who scored it
Scored by	CVSS	Score	Vector
CERTVDECNA (assigner)	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.74% · top 45% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

CWE-732: Incorrect Permission Assignment for Critical Resource (opens in a new tab)All about CWE-732 and its CVEs

Affected products

PHOENIX CONTACT · AXC F 1152
- affected ≤ 2024.0
PHOENIX CONTACT · AXC F 2152
- affected ≤ 2024.0
PHOENIX CONTACT · AXC F 3152
- affected ≤ 2024.0
PHOENIX CONTACT · BPC 9102S
- affected ≤ 2024.0
PHOENIX CONTACT · EPC 1502
- affected ≤ 2024.0
PHOENIX CONTACT · EPC 1522
- affected ≤ 2024.0
PHOENIX CONTACT · PLCnext Engineer
- affected ≤ 2024.0
PHOENIX CONTACT · RFC 4072R
- affected ≤ 2024.0
PHOENIX CONTACT · RFC 4072S
- affected ≤ 2024.0

References (1)

https://https://cert.vde.com/en/advisories/VDE-2023-056/ (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-46142](https://trackcve.app/badge/CVE-2023-46142.svg)](https://trackcve.app/cve/CVE-2023-46142)

Record last updated 2 Aug 2024, 20:37 UTC.