title: Phoenix Contact: PC Worx/-Express prone to improper input validation vulnerability
description: Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory.
problem types: CWE-20 Improper Input Validation
affected:
{
product: PC Worx
vendor: Phoenix Contact
versions:
lessThanOrEqual: 1.88, status: affected, version: PC Worx, versionType: custom
lessThanOrEqual: 1.88, status: affected, version: PC Worx-Express, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: With the next version of Automation Worx Software Suite additional plausibility checks for archive content will be implemented.
workarounds: Temporary Fix / Mitigation
We strongly recommend customers to exchange project files only using secure file exchange services. Project files should not be exchanged via unencrypted email.
In addition, we recommend exchanging or storing project files together with a checksum to ensure their integrity.