Read the docs
TI-2019-12471 Aliases CVE-2019-16675GHSA-5f64-wpvq-45hw

An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through…

Priority MEDIUM 40CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-of-bounds Read and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project to be able to manipulate data inside. After manipulation, the attacker needs to exchange the original files with the manipulated ones on the application programming workstation.

Why it matters now

EPSS 0.03306 88th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:phoenixcontact:config\+:*:*:*:*:*:*:*:*up to 1.86VulnerablePhoenixcontact
cpe:2.3:a:phoenixcontact:pc_worx:*:*:*:*:*:*:*:*up to 1.86VulnerablePhoenixcontact
cpe:2.3:a:phoenixcontact:pc_worx_express:*:*:*:*:*:*:*:*up to 1.86VulnerablePhoenixcontact
  • cpe:2.3:a:phoenixcontact:config\+:*:*:*:*:*:*:*:* Versions up to 1.86 Vulnerable ·Phoenixcontact
  • cpe:2.3:a:phoenixcontact:pc_worx:*:*:*:*:*:*:*:* Versions up to 1.86 Vulnerable ·Phoenixcontact
  • cpe:2.3:a:phoenixcontact:pc_worx_express:*:*:*:*:*:*:*:* Versions up to 1.86 Vulnerable ·Phoenixcontact

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-16675
  2. 2026-10-03 Alias added: GHSA-5f64-wpvq-45hw

References

Advisory 3

Other 1

  • TI-2023-24782 Incorrect permission assignment in Phoenix Contact Automation Worx Software Suite CVSS 3.1CRITICAL 9.8
  • TI-2023-24784 Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC CVSS 3.1HIGH 7.5
  • TI-2021-12937 Phoenix Contact: Automation Worx Software Suite affected by Remote Code Execution (RCE) vulnerability CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences