Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC
Priority LOW 39CWE-494Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-494.
Summary
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00332 26th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Phoenix Contact | Automation Worx Software Suite | all | — | No fix listed | CNA |
| Phoenix Contact | AXC 1050 | all | — | No fix listed | CNA |
| Phoenix Contact | AXC 1050 XC | all | — | No fix listed | CNA |
| Phoenix Contact | AXC 3050 | all | — | No fix listed | CNA |
| Phoenix Contact | Config+ | all | — | No fix listed | CNA |
| Phoenix Contact | FC 350 PCI ETH | all | — | No fix listed | CNA |
| Phoenix Contact | ILC1x0 | all | — | No fix listed | CNA |
| Phoenix Contact | ILC1x1 | all | — | No fix listed | CNA |
| Phoenix Contact | ILC 3xx | all | — | No fix listed | CNA |
| Phoenix Contact | PC Worx | all | — | No fix listed | CNA |
| Phoenix Contact | PC Worx Express | all | — | No fix listed | CNA |
| Phoenix Contact | PC WORX RT BASIC | all | — | No fix listed | CNA |
| Phoenix Contact | PC WORX SRT | all | — | No fix listed | CNA |
| Phoenix Contact | RFC 430 ETH-IB | all | — | No fix listed | CNA |
| Phoenix Contact | RFC 450 ETH-IB | all | — | No fix listed | CNA |
| Phoenix Contact | RFC 460R PN 3TX | all | — | No fix listed | CNA |
| Phoenix Contact | RFC 470S PN 3TX | all | — | No fix listed | CNA |
| Phoenix Contact | RFC 480S PN 4TX | all | — | No fix listed | CNA |
- Automation Worx Software Suite VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- AXC 1050 VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- AXC 1050 XC VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- AXC 3050 VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- Config+ VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- FC 350 PCI ETH VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- ILC1x0 VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- ILC1x1 VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- ILC 3xx VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- PC Worx VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- PC Worx Express VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- PC WORX RT BASIC VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- PC WORX SRT VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- RFC 430 ETH-IB VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- RFC 450 ETH-IB VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- RFC 460R PN 3TX VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- RFC 470S PN 3TX VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
- RFC 480S PN 4TX VendorPhoenix Contact Affected all Fixed in — No fix listed CNA
CPE configurations NVD · 31
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phoenixcontact:automationworx_software_suite:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axc_1050_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axc_1050:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axc_1050_xc_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axc_1050_xc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axc_3050_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axc_3050:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:a:phoenixcontact:config\+:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:fc_350_pci_eth_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:fc_350_pci_eth:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
- cpe:2.3:a:phoenixcontact:automationworx_software_suite:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axc_1050_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axc_1050:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axc_1050_xc_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axc_1050_xc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axc_3050_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axc_3050:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:a:phoenixcontact:config\+:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:fc_350_pci_eth_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:fc_350_pci_eth:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
Show 21 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:phoenixcontact:ilc1x0_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:ilc1x0:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:ilc1x1_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:ilc1x1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:ilc_3xx_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:ilc_3xx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:a:phoenixcontact:pc_worx:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:a:phoenixcontact:pc_worx_express:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:pc_worx_rt_basic_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:pc_worx_rt_basic:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:a:phoenixcontact:pc_worx_srt:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_430_eth-ib_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_430_eth-ib:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_450_eth-ib_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_450_eth-ib:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_460r_pn_3tx_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_460r_pn_3tx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_470s_pn_3tx_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_470s_pn_3tx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:rfc_480s_pn_4tx_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:rfc_480s_pn_4tx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
- cpe:2.3:o:phoenixcontact:ilc1x0_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:ilc1x0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:ilc1x1_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:ilc1x1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:ilc_3xx_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:ilc_3xx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:a:phoenixcontact:pc_worx:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:a:phoenixcontact:pc_worx_express:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:pc_worx_rt_basic_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:pc_worx_rt_basic:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:a:phoenixcontact:pc_worx_srt:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_430_eth-ib_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_430_eth-ib:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_450_eth-ib_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_450_eth-ib:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_460r_pn_3tx_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_460r_pn_3tx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_470s_pn_3tx_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_470s_pn_3tx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:rfc_480s_pn_4tx_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:rfc_480s_pn_4tx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-46143
- 2026-10-03 Alias added: GHSA-frfw-grgg-284c
References
More Phoenix Contact vulnerabilities
- TI-2014-07463 Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function CVSS 2.0CRITICAL 10.0
- TI-2024-17093 PHOENIX CONTACT: Remote code execution in CHARX Series CVSS 3.1CRITICAL 9.8
- TI-2022-13692 Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers CVSS 3.1CRITICAL 9.8
- TI-2026-21959 Remote code execution via uploading a malicious IODD file CVSS 3.1CRITICAL 9.8
- TI-2026-21940 Authentication Bypass in _account_log CVSS 3.1CRITICAL 9.8
- TI-2023-03334 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels CVSS 3.1CRITICAL 10.0
Sources
- CVE-2023-46143 · CVE Program
- CVE-2023-46143 · NVD
- FIRST EPSS
- GHSA-frfw-grgg-284c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences