Back to overview

PHOENIX CONTACT: Niche Ethernet Stack for ILC1x0, ILC1x1 and AXC 1050 Industrial controllers and CHARX control DC

VDE-2021-032
Last update
05/22/2025 15:03
Published at
08/04/2021 09:57
Vendor(s)
Phoenix Contact GmbH & Co. KG
External ID
VDE-2021-032
CSAF Document
Download

Summary

Third party Niche Ethernet stack has several vulnerabilities announced by the security researcher's community.
Phoenix Contact Classic Line industrial controllers are developed and designed for the use in closed industrial networks. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a Denial of Service or a Breach of Integrity of the PLC.

Impact

A successful attack to the Niche Ethernet stack can lead to Denial of Service or a Breach of Integrity of the PLC.

Affected Product(s)

Model no. Product name Affected versions
2700988, 2701295 AXC 1050 Firmware vers:all/*
1624130 EV-PLCC-AC1-DC1 Firmware vers:all/*
ILC1x0 Firmware vers:all/*
2700973, 2700974, 2700975, 2700976, 2701034, 2701141 ILC1x1 Firmware vers:all/*

Vulnerabilities

Expand / Collapse all

Published
09/22/2025 14:57
Severity
9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
Use of Insufficiently Random Values (CWE-330)
References
cve.org | nvd.nist.gov

Published
09/22/2025 14:57
Severity
7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
Out-of-bounds Write (CWE-787)
References
cve.org | nvd.nist.gov

Published
09/22/2025 14:57
Severity
7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
Improper Input Validation (CWE-20)
References
cve.org | nvd.nist.gov

Published
09/22/2025 14:57
Severity
7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
Improper Input Validation (CWE-20)
References
cve.org | nvd.nist.gov

Published
09/22/2025 14:57
Severity
7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
References
cve.org | nvd.nist.gov

Published
09/22/2025 14:57
Severity
7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
Improper Input Validation (CWE-20)
References
cve.org | nvd.nist.gov

Mitigation

Customers using Phoenix Contact Classic Line Controllers are strongly recommended to operate the devices in closed networks or protected with a suitable firewall as intended. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:
Measures to protect network-capable devices with Ethernet connection

Remediation

Phoenix Contact Classic Line Controllers are designed and developed for the use in closed industrial networks. The control and configuration protocols do not feature authentication mechanisms by design. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.
Phoenix Contact is offering the mGuard product family for network segmentation and protection.

Revision History

Version Date Summary
1 08/04/2021 09:57 initial revision
2 05/22/2025 15:03 Fix: quotation mark