Skip to content
OpenAdvisories
High ICSA-20-191-01 2 CVEs

Phoenix Contact Automation Worx Software Suite

Published Jul 9, 2020 · Updated Jul 9, 2020

Vendor: Phoenix Contact Product: PC Worx Product: PC Worx Express

Summary

Successful exploitation could allow an attacker to execute arbitrary code under the privileges of the application.

Vulnerabilities 2

  • High 7.8
    CVE-2020-12497 EPSS 15%

    Phoenix Contact Automation Worx <= 1.87: stack-based overflow

    PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

    Phoenix Contact Automation Worx Automation Worx Express ICS / OT
  • High 7.8
    CVE-2020-12498

    Phoenix Contact Automation Worx <= 1.87: out-of-bounds read remote code execution

    mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

    Phoenix Contact Automation Worx Express Automation Worx ICS / OT

Revision history

  1. #1

    ICSA-20-191-01 Phoenix Contact Automation Worx Software Suite

References