Phoenix Contact: Automation Worx Software Suite affected by Remote Code Execution (RCE) vulnerability
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-824 and the CVSS impact.
Summary
Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The attacker needs to get access to an original bus configuration file (*.bcp) to be able to manipulate data inside. After manipulation the attacker needs to exchange the original file by the manipulated one on the application programming workstation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Phoenix Contact | Automation Worx Software Suite | PC Worx – 1.87; PC Worx Express – 1.87; Config+ – 1.87 | — | No fix listed | CNA |
- Automation Worx Software Suite VendorPhoenix Contact Affected PC Worx – 1.87; PC Worx Express – 1.87; Config+ – 1.87 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phoenixcontact:config\+:*:*:*:*:*:*:*:* | up to 1.87 | Vulnerable | Phoenixcontact |
| cpe:2.3:a:phoenixcontact:pc_worx:*:*:*:*:*:*:*:* | up to 1.87 | Vulnerable | Phoenixcontact |
| cpe:2.3:a:phoenixcontact:pc_worx_express:*:*:*:*:*:*:*:* | up to 1.87 | Vulnerable | Phoenixcontact |
- cpe:2.3:a:phoenixcontact:config\+:*:*:*:*:*:*:*:* Versions up to 1.87 Vulnerable ·Phoenixcontact
- cpe:2.3:a:phoenixcontact:pc_worx:*:*:*:*:*:*:*:* Versions up to 1.87 Vulnerable ·Phoenixcontact
- cpe:2.3:a:phoenixcontact:pc_worx_express:*:*:*:*:*:*:*:* Versions up to 1.87 Vulnerable ·Phoenixcontact
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33542
- 2026-10-03 Alias added: GHSA-88r6-jjq4-269q
References
More Phoenix Contact vulnerabilities
- TI-2014-07463 Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function CVSS 2.0CRITICAL 10.0
- TI-2024-17093 PHOENIX CONTACT: Remote code execution in CHARX Series CVSS 3.1CRITICAL 9.8
- TI-2022-13692 Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers CVSS 3.1CRITICAL 9.8
- TI-2026-21959 Remote code execution via uploading a malicious IODD file CVSS 3.1CRITICAL 9.8
- TI-2026-21940 Authentication Bypass in _account_log CVSS 3.1CRITICAL 9.8
- TI-2023-03334 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels CVSS 3.1CRITICAL 10.0
Sources
- CVE-2021-33542 · CVE Program
- CVE-2021-33542 · NVD
- FIRST EPSS
- GHSA-88r6-jjq4-269q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences