An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.
Summary
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to a Use-After-Free and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project file to be able to manipulate it. After manipulation, the attacker needs to exchange the original file with the manipulated one on the application programming workstation.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phoenixcontact:automationworx_software_suite:*:*:*:*:*:*:*:* | up to 1.86 | Vulnerable | Phoenixcontact |
- cpe:2.3:a:phoenixcontact:automationworx_software_suite:*:*:*:*:*:*:*:* Versions up to 1.86 Vulnerable ·Phoenixcontact
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12871
- 2026-10-03 Alias added: GHSA-534j-x2x2-hv47
References
More Phoenixcontact Automationworx Software Suite vulnerabilities
- TI-2019-09638 An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through… CVSS 3.0HIGH 8.8
- TI-2023-24782 Incorrect permission assignment in Phoenix Contact Automation Worx Software Suite CVSS 3.1CRITICAL 9.8
- TI-2019-09639 An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through… CVSS 3.0HIGH 8.8
- TI-2023-24784 Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC CVSS 3.1HIGH 7.5
- TI-2022-03432 Out-of-bounds Read in PHOENIX CONTACT Automationworx Software Suite CVSS 3.1HIGH 7.8
- TI-2022-03196 Buffer Overflow in PHOENIX CONTACT Automationworx Software Suite CVSS 3.1HIGH 7.8
Sources
- CVE-2019-12871 · CVE Program
- CVE-2019-12871 · NVD
- FIRST EPSS
- GHSA-534j-x2x2-hv47 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences