Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers
Priority MEDIUM 52CWE-345Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-345.
Summary
An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01571 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Phoenix Contact | ILC 1x0 | All Versions | — | No fix listed | CNA |
| Phoenix Contact | ILC 1x1 | All Versions | — | No fix listed | CNA |
| Phoenix Contact | ILC 1x1 GSM/GPRS | All Versions | — | No fix listed | CNA |
| Phoenix Contact | ILC 3xx | All Versions | — | No fix listed | CNA |
| Phoenix Contact | AXC 1050 | All Versions | — | No fix listed | CNA |
| Phoenix Contact | AXC 1050 XC | All Versions | — | No fix listed | CNA |
| Phoenix Contact | AXC 3050 | All Versions | — | No fix listed | CNA |
| Phoenix Contact | RFC 480S PN 4TX | All Versions | — | No fix listed | CNA |
| Phoenix Contact | RFC 470 PN 3TX | All Versions | — | No fix listed | CNA |
| Phoenix Contact | RFC 470S PN 3TX | All Versions | — | No fix listed | CNA |
| Phoenix Contact | RFC 460R PN 3TX | All Versions | — | No fix listed | CNA |
| Phoenix Contact | RFC 460R PN 3TX-S | All Versions | — | No fix listed | CNA |
| Phoenix Contact | RFC 430 ETH-IB | All Versions | — | No fix listed | CNA |
| Phoenix Contact | RFC 450 ETH-IB | All Versions | — | No fix listed | CNA |
| Phoenix Contact | PC WORX SRT | All Versions | — | No fix listed | CNA |
| Phoenix Contact | PC WORX RT BASIC | All Versions | — | No fix listed | CNA |
| Phoenix Contact | FC 350 PCI ETH | All Versions | — | No fix listed | CNA |
- ILC 1x0 VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- ILC 1x1 VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- ILC 1x1 GSM/GPRS VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- ILC 3xx VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- AXC 1050 VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- AXC 1050 XC VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- AXC 3050 VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- RFC 480S PN 4TX VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- RFC 470 PN 3TX VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- RFC 470S PN 3TX VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- RFC 460R PN 3TX VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- RFC 460R PN 3TX-S VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- RFC 430 ETH-IB VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- RFC 450 ETH-IB VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- PC WORX SRT VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- PC WORX RT BASIC VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
- FC 350 PCI ETH VendorPhoenix Contact Affected All Versions Fixed in — No fix listed CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:phoenixcontact:axc_1050_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axc_1050:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axc_1050_xc_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axc_1050_xc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axc_3050_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axc_3050:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:fc_350_pci_eth_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:fc_350_pci_eth:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:ilc1x0_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:ilc1x0:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
- cpe:2.3:o:phoenixcontact:axc_1050_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axc_1050:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axc_1050_xc_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axc_1050_xc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axc_3050_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axc_3050:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:fc_350_pci_eth_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:fc_350_pci_eth:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:ilc1x0_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:ilc1x0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:phoenixcontact:ilc1x1_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:ilc1x1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:ilc_1x1_gsm\/gprs_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:ilc_1x1_gsm\/gprs:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:ilc_3xx_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:ilc_3xx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:pc_worx_rt_basic_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:pc_worx_rt_basic:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:pc_worx_srt_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:pc_worx_srt:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_430_eth-ib_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_430_eth-ib:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_450_eth-ib_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_450_eth-ib:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_460r_pn_3tx_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_460r_pn_3tx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_460r_pn_3tx-s_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_460r_pn_3tx-s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_470_pn_3tx_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_470_pn_3tx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_470s_pn_3tx_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_470s_pn_3tx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_480s_pn_4tx_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_480s_pn_4tx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
- cpe:2.3:o:phoenixcontact:ilc1x1_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:ilc1x1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:ilc_1x1_gsm\/gprs_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:ilc_1x1_gsm\/gprs:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:ilc_3xx_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:ilc_3xx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:pc_worx_rt_basic_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:pc_worx_rt_basic:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:pc_worx_srt_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:pc_worx_srt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_430_eth-ib_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_430_eth-ib:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_450_eth-ib_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_450_eth-ib:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_460r_pn_3tx_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_460r_pn_3tx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_460r_pn_3tx-s_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_460r_pn_3tx-s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_470_pn_3tx_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_470_pn_3tx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_470s_pn_3tx_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_470s_pn_3tx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_480s_pn_4tx_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_480s_pn_4tx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31800
- 2026-10-03 Alias added: GHSA-m7x4-j34m-52hc
References
More Phoenix Contact vulnerabilities
- TI-2014-07463 Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function CVSS 2.0CRITICAL 10.0
- TI-2024-17093 PHOENIX CONTACT: Remote code execution in CHARX Series CVSS 3.1CRITICAL 9.8
- TI-2026-21959 Remote code execution via uploading a malicious IODD file CVSS 3.1CRITICAL 9.8
- TI-2026-21940 Authentication Bypass in _account_log CVSS 3.1CRITICAL 9.8
- TI-2023-03334 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels CVSS 3.1CRITICAL 10.0
- TI-2022-13693 Insufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering tool CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-31800 · CVE Program
- CVE-2022-31800 · NVD
- FIRST EPSS
- GHSA-m7x4-j34m-52hc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences