CVE-2023-46142

Published: Dec 14, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: info@cert.vde.com (Secondary)

Description

A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.

Affected (9)

Products: Phoenixcontact: Axc F 1152 Firmware, Axc F 2152 Firmware, Axc F 3152 Firmware, Bpc 9102s Firmware, Epc 1502 Firmware, Epc 1522 Firmware, Plcnext Engineer, Rfc 4072r Firmware, Rfc 4072s Firmware

9 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Axc F 1152 Firmware	Up to 2024.0

Running on/with	Platform Versions
Phoenixcontact Axc F 1152	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Axc F 2152 Firmware	Up to 2024.0

Running on/with	Platform Versions
Phoenixcontact Axc F 2152	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Axc F 3152 Firmware	Up to 2024.0

Running on/with	Platform Versions
Phoenixcontact Axc F 3152	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Bpc 9102s Firmware	Up to 2024.0

Running on/with	Platform Versions
Phoenixcontact Bpc 9102s	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Epc 1502 Firmware	Up to 2024.0

Running on/with	Platform Versions
Phoenixcontact Epc 1502	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Epc 1522 Firmware	Up to 2024.0

Running on/with	Platform Versions
Phoenixcontact Epc 1522	All versions

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Phoenixcontact Plcnext Engineer	Up to 2024.0

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Rfc 4072r Firmware	Up to 2024.0

Running on/with	Platform Versions
Phoenixcontact Rfc 4072r	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Rfc 4072s Firmware	Up to 2024.0

Running on/with	Platform Versions
Phoenixcontact Rfc 4072s	All versions

Related CWEs

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (2)

https://https://cert.vde.com/en/advisories/VDE-2023-056/

Source: info@cert.vde.com

Broken Link

https://https://cert.vde.com/en/advisories/VDE-2023-056/

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.