CVE-2023-46142

EUVD-2023-50385
A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CERTVDECNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
Affected Products (NVD)
VendorProductVersion
phoenixcontactaxc_f_1152_firmware
𝑥
≤ 2024.0
phoenixcontactaxc_f_2152_firmware
𝑥
≤ 2024.0
phoenixcontactaxc_f_3152_firmware
𝑥
≤ 2024.0
phoenixcontactbpc_9102s_firmware
𝑥
≤ 2024.0
phoenixcontactepc_1502_firmware
𝑥
≤ 2024.0
phoenixcontactepc_1522_firmware
𝑥
≤ 2024.0
phoenixcontactplcnext_engineer
𝑥
≤ 2024.0
phoenixcontactrfc_4072r_firmware
𝑥
≤ 2024.0
phoenixcontactrfc_4072s_firmware
𝑥
≤ 2024.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://https://cert.vde.com/en/advisories/VDE-2023-056/
https://https://cert.vde.com/en/advisories/VDE-2023-056/