title: Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC
description: Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.
problem types: CWE-494 Download of Code Without Integrity Check
affected:
{
defaultStatus: unaffected
product: Automation Worx Software Suite
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: AXC 1050
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: AXC 1050 XC
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: AXC 3050
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: Config+
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: FC 350 PCI ETH
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: ILC1x0
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: ILC1x1
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: ILC 3xx
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: PC Worx
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: PC Worx Express
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: PC WORX RT BASIC
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: PC WORX SRT
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: RFC 430 ETH-IB
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: RFC 450 ETH-IB
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: RFC 460R PN 3TX
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: RFC 470S PN 3TX
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: RFC 480S PN 4TX
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL