Back to overview

PHOENIX CONTACT: Vulnerability in classic line industrial controllers

VDE-2022-025
Last update
05/22/2025 15:03
Published at
06/21/2022 07:15
Vendor(s)
Phoenix Contact GmbH & Co. KG
External ID
VDE-2022-025
CSAF Document
Download

Summary

The affected devices insufficiently verify uploaded data.

Impact

An attacker capable of either transmitting manipulated logic or manipulating legitimate logic can execute arbitrary malicious code on the device.

Affected Product(s)

Model no. Product name Affected versions
AXC 1050 Firmware vers:all/*
2701295 AXC 1050 XC Firmware vers:all/*
2700989 AXC 3050 Firmware vers:all/*
2730844 FC 350 PCI ETH Firmware vers:all/*
2700977 ILC 1x1 GSM/GPRS Firmware vers:all/*
ILC 3xx Firmware vers:all/*
ILC1x0 Firmware vers:all/*
ILC1x1 Firmware vers:all/*
2700291 PC WORX RT BASIC Firmware vers:all/*
2701680 PC WORX SRT Firmware vers:all/*
2730190 RFC 430 ETH-IB Firmware vers:all/*
2730200 RFC 450 ETH-IB Firmware vers:all/*
2700784 RFC 460R PN 3TX Firmware vers:all/*
1096407 RFC 460R PN 3TX-S Firmware vers:all/*
2916600 RFC 470 PN 3TX Firmware vers:all/*
2916794 RFC 470S PN 3TX Firmware vers:all/*
2404577 RFC 480S PN 4TX Firmware vers:all/*

Vulnerabilities

Expand / Collapse all

Published
09/22/2025 14:58
Severity
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
Insufficient Verification of Data Authenticity (CWE-345)
Summary

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.

References
cve.org | nvd.nist.gov

Mitigation

Phoenix Contact classic line controllers are designed and developed for the use in closed industrial networks. The controller doesn't feature logic integrity and authenticity checks by design. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.

Customers using Phoenix Contact classic line controllers are recommended to operate the devices in closed networks or protected with a suitable firewall as intended.

Generic information and recommendations for security measures to protect network-capabledevices can be found in the application note.

Revision History

Version Date Summary
1 06/21/2022 07:15 Initial revision.
2 05/22/2025 15:03 Fix: added distribution, quotation mark