Vulnerability · Published Nov 4, 2021 · Assigned by CERTVDE
CVE-2021-34597Phoenix Contact: PC Worx/-Express prone to improper input validation vulnerability
High 7.8
In plain English
A high-severity improper input validation in PC Worx from Phoenix Contact. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.7%top 48.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Phoenix Contact | PC Worx | PC Worx – through 1.88PC Worx-Express – through 1.88 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://cert.vde.com/en/advisories/VDE-2021-052/ x_refsource_CONFIRM