Critical ICSA-22-172-03 1 CVE

Phoenix Contact Classic Line Controllers

Published Jun 21, 2022 · Updated Jun 21, 2022

Vendor: Phoenix Contact Product: AXC 1050 Product: AXC 1050 XC Product: AXC 3050 Product: FC 350 PCI ETH Product: ILC 1x0 Product: ILC 1x1 Product: ILC 1x1 GSM/GPRS Product: ILC 3xx Product: PC WORX RT BASIC Product: PC WORX SRT Product: RFC 430 ETH-IB Product: RFC 450 ETH-IB Product: RFC 460R PN 3TX Product: RFC 460R PN 3TX-S Product: RFC 470 PN 3TX Product: RFC 470S PN 3TX Product: RFC 480S PN 4TX

Summary

Successful exploitation of this vulnerability could allow an attacker to upload logic with arbitrary code.

Vulnerabilities 1

Critical 9.8

CVE-2022-31800

Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.

Phoenix Contact RFC 430 ETH-IB AXC 1050 XC PC WORX SRT ICS / OT

Jun 21, 2022

Revision history

2022-06-21 #1
Publication Date

References

ICS Advisory ICSA-22-172-03 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-172-03
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B