title: Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource
description: Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.
problem types: CWE-732 Incorrect Permission Assignment for Critical Resource
affected:
{
defaultStatus: unaffected
product: Automation Worx Software Suite
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: AXC 1050
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: AXC 1050 XC
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: AXC 3050
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: Config+
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: FC 350 PCI ETH
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: ILC1x0
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: ILC1x1
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: ILC 3xx
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: PC Worx
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: PC Worx Express
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: PC WORX RT BASIC
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: PC WORX SRT
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: RFC 430 ETH-IB
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: RFC 450 ETH-IB
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: RFC 460R PN 3TX
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: RFC 470S PN 3TX
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
{
defaultStatus: unaffected
product: RFC 480S PN 4TX
vendor: PHOENIX CONTACT
versions:
status: affected, version: all
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL