Skip to content
OpenAdvisories
High VDE-2021-052 1 CVE

PHOENIX CONTACT: PC Worx/-Express prone to improper input validation vulnerability

Published Nov 3, 2021 · Updated May 22, 2025 · Revision 2

Vendor: Phoenix Contact Product: PC Worx Product: PC Worx Express

Summary

PC Worx / -Express is vulnerable to a 'zip slip' style vulnerability when loading a project file.

Details

Impact
Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities.
Automated systems in operation which were programmed with one of the above-mentioned products are not affected.

Mitigation
We strongly recommend customers to exchange project files only using secure file exchange services. Project files should not be exchanged via unencrypted email.
In addition, we recommend exchanging or storing project files together with a checksum to ensure their integrity.

Remediation
With the next version of Automation Worx Software Suite additional plausibility checks for archive content will be implemented.

Vulnerabilities 1

  • High 7.8
    CVE-2021-34597

    Phoenix Contact: PC Worx/-Express prone to improper input validation vulnerability

    Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory.

    Phoenix Contact PC Worx ICS / OT

Revision history

  1. #2

    Fix: quotation mark

  2. #1

    initial revision

References