title: PHOENIX CONTACT: PLCnext Control prone to download of code without integrity check
description: A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.
problem types: CWE-494: Download of Code Without Integrity Check
affected:
{
defaultStatus: unaffected
product: AXC F 1152
vendor: PHOENIX CONTACT
versions:
lessThanOrEqual: 2024.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: AXC F 2152
vendor: PHOENIX CONTACT
versions:
lessThanOrEqual: 2024.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: AXC F 3152
vendor: PHOENIX CONTACT
versions:
lessThanOrEqual: 2024.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: BPC 9102S
vendor: PHOENIX CONTACT
versions:
lessThanOrEqual: 2024.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: EPC 1502
vendor: PHOENIX CONTACT
versions:
lessThanOrEqual: 2024.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: EPC 1522
vendor: PHOENIX CONTACT
versions:
lessThanOrEqual: 2024.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: PLCnext Engineer
vendor: PHOENIX CONTACT
versions:
lessThanOrEqual: 2024.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: RFC 4072R
vendor: PHOENIX CONTACT
versions:
lessThanOrEqual: 2024.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: RFC 4072S
vendor: PHOENIX CONTACT
versions:
lessThanOrEqual: 2024.0, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL